CVE-2025-24876
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2025-24876 is a high-severity Authentication Bypass by Assumed-Immutable Data (CWE-302) vulnerability in Sap (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 39th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and SI-10 (Information Input Validation) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-24876 is an authentication bypass vulnerability in the SAP Approuter Node.js package, specifically versions v16.7.1 and earlier. The flaw occurs when trading an authorization code, allowing an attacker to inject a malicious payload and steal the victim's session. This impacts confidentiality and integrity at a high level, as classified by CWEs CWE-302 and CWE-1287, with an overall CVSS score of 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N).
The vulnerability is exploitable remotely over the network (AV:N) with low complexity (AC:L) and no privileges required (PR:N), though it requires user interaction (UI:R) such as clicking a malicious link or processing a crafted payload. Successful exploitation enables an unauthenticated attacker to hijack the victim's authenticated session, potentially granting unauthorized access to sensitive application data and functions without affecting availability (A:N).
SAP advisories provide mitigation guidance, including SAP Note 3567974 available at https://me.sap.com/notes/3567974 and details on SAP Security Patch Day at https://url.sap/sapsecuritypatchday. The npm package page for @sap/approuter at https://www.npmjs.com/package/@sap/approuter?activeTab=versions lists available updates to address the issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-3971
Vulnerability Data
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of…
more
the application
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.1.1V1.4.2V2.1.1V2.2.2
Mitigating Controls (NIST 800-53 r5) AI
Mandates proper unique identification and authentication of users, precluding reliance on attacker-controlled immutable assumptions.
SI-10 directly requires validation of information inputs, which structurally prevents type-validation failures from being introduced or exploitable.
Requires server-side enforcement of authorizations instead of trusting client-supplied mutable data for authentication decisions.
Mandates proper identification and authentication for non-organizational users, precluding reliance on attacker-controlled immutable assumptions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Strong authentication mechanisms directly avoid reliance on attacker-controlled immutable data.
Protecting and verifying identity assertions prevents tampering with data assumed immutable during auth.
Secure SDLC practices directly require proper input type validation during development.
Least-privilege authorization policies reduce impact of bypassed authentication but do not address the root flaw.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can discover and block authentication bypasses that rely on mutable data.
Access-control policy can mandate validation of all identity data, reducing reliance on assumed-immutable fields.
Identity-management processes can require verification of mutable attributes, mitigating the root cause.
Proper management of authentication information prevents use of client-controlled tokens or cookies as sole proof of identity.
Access-rights reviews can detect and revoke rights granted via tampered immutable data.
Secure SDLC practices include threat modeling and input-validation requirements that catch assumed-immutable data flaws.