CVE-2025-24876: Authentication bypass via authorization code injection in SAP Approuter
First published: Tue Feb 11 2025(Updated: )
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application
Credit: cna@sap.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| SAP Approuter | <v16.7.1 | |
| npm/@sap/approuter | >=2.6.1<16.7.2 | 16.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://me.sap.com/notes/3567974
- https://www.npmjs.com/package/@sap/approuter?activeTab=versions
- https://url.sap/sapsecuritypatchday
- https://nvd.nist.gov/vuln/detail/CVE-2025-24876
- https://support.sap.com/en/my-support/knowledge-base/security-notes-news/february-2025.html
- https://github.com/advisories/GHSA-cpfx-964w-4jvp (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-24876?
CVE-2025-24876 is classified as a High severity vulnerability due to its potential impact on confidentiality and integrity.
How do I fix CVE-2025-24876?
To fix CVE-2025-24876, upgrade the SAP Approuter Node.js package to a version later than v16.7.1.
What are the consequences of exploiting CVE-2025-24876?
Exploiting CVE-2025-24876 allows attackers to bypass authentication and potentially steal sessions from victims.
Which versions of SAP Approuter are affected by CVE-2025-24876?
SAP Approuter version v16.7.1 and earlier are affected by CVE-2025-24876.
Is there a known workaround for CVE-2025-24876?
Currently, there are no widely recognized workarounds for CVE-2025-24876; updating to a fixed version is the recommended approach.
- agent/title
- agent/type
- agent/first-publish-date
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- agent/author
- agent/severity
- agent/weakness
- collector/nvd-api
- source/NVD
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-cpfx-964w-4jvp
- alias/CVE-2025-24876
- agent/last-modified-date
- agent/description
- agent/source
- agent/tags
- agent/references
- agent/softwarecombine
- agent/event
- collector/mitre-cve
- source/MITRE
- collector/epss-latest
- source/FIRST
- agent/epss
- collector/nvd-cve
- vendor/sap
- canonical/sap approuter
- package-manager/npm