CVE-2025-24876 Authentication bypass via authorization code injection in SAP Approuter
Attackers can bypass authentication and steal victim sessions by injecting malicious payloads during authorization code trading in SAP Approuter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2025-24876?
CVE-2025-24876 is a high-severity authentication bypass vulnerability in SAP_SE SAP Approuter Node.js package, published on 11 Feb 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application
Which versions are affected by CVE-2025-24876?
2 open source packages ship an affected version, including @sap/approuter.
| Package | Affected | Fixed in |
|---|---|---|
@sap/approuter npm | From 2.6.1 | 16.7.2 |
@sap/approuter npm | From 2.6.1 | 16.7.2 |
How do I fix CVE-2025-24876?
Upgrade @sap/approuter to 16.7.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-24876 being exploited?
There is no known exploitation of CVE-2025-24876 in the wild and no public exploit code.
Sources
Also known as GHSA-cpfx-964w-4jvp.