Vulnerability · Published Feb 11, 2025 · Assigned by sap
CVE-2025-24876Authentication bypass via authorization code injection in SAP Approuter
High 8.1
In plain English
A high-severity security flaw in SAP Approuter Node.js package from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.5%top 57.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @sap/approuter | 16.7.2 | GHSA-cpfx-964w-4jvp |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| SAP_SE | SAP Approuter Node.js package | 2.6.1 to 16.7.1 |
Weakness: CWE-1287, CWE-302 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N