Riskcovery

CVE-2025-24876

Authentication bypass via authorization code injection in SAP Approuter

State
Published
Severity
8.1 High
Published
Feb 11, 2025
Updated
Feb 21, 2025
Reserved
Jan 27, 2025

Read the record on cve.org

Description

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application

Scores

CVSSScoreVectorSource
3.18.1 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Nsap

Weaknesses

  • CWE-1287 Improper Validation of Specified Type of Input
  • CWE-302 Authentication Bypass by Assumed-Immutable Data

Affected Products

ProductVersions
SAP Approuter Node.js packageSAP_SE
  • 2.6.1 to 16.7.1Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.