How severe is CVE-2025-24876?

This vulnerability has a severity rating of HIGH with a CVSS score of 8.1 out of 10.

What type of vulnerability is CVE-2025-24876?

This is classified as CWE-302, which is a common weakness in software security.

CVE-2025-24876 - HIGH Severity | CVSS 8.1

Vulnerability Description

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application

Related Vulnerabilities

CVE-2020-15074

HIGH

CVSS:7.5(High)

OpenVPN Access Server older than version 2.8.4 and version 2.9.5 generates new user authentication tokens instead of reusing exiting tokens on reconnect making it possible to circumvent the initial to...

CWE-3022020

CVE-2022-3875

HIGH

CVSS:7.5(High)

A vulnerability classified as critical was found in Click Studios Passwordstate and Passwordstate Browser Extension Chrome. This vulnerability affects unknown code of the component API. The manipulati...

CWE-3022022

CVE-2024-22179

HIGH

CVSS:7.5(High)

The application is vulnerable to an unauthenticated parameter manipulation that allows an attacker to set the credentials to blank giving her access to the admin panel. Also vulnerable to account take...

CWE-3022024

CVE-2024-3741

HIGH

CVSS:7.5(High)

Electrolink transmitters are vulnerable to an authentication bypass vulnerability affecting the login cookie. An attacker can set an arbitrary value except 'NO' to the login cookie and have full syste...

CWE-3022024

CVE-2022-22729

HIGH

CVSS:8.8(High)

CAMS for HIS Server contained in the following Yokogawa Electric products improperly authenticate the receiving packets. The authentication may be bypassed via some crafted packets: CENTUM CS 3000 ver...

CWE-3022022

CVE-2024-12838

HIGH

CVSS:8.8(High)

The passwordless login mechanism in CGFIDO from Changing Information Technology has an Authentication Bypass vulnerability, allowing remote attackers with regular privileges to send a crafted request ...

CWE-3022024