Cyber Resilience

CVE-2025-43916

Published
21 April 2025
Modified
17 June 2026
CVSS Score v3.1 3.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N
EPSS Score 0.0021 11th percentile
Risk Priority 29 floored blend · peak EPSS

Summary

CVE-2025-43916 is a low-severity Use of Non-Canonical URL Paths for Authorization Decisions (CWE-647) vulnerability. Its CVSS base score is 3.4 (Low).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 11th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Sonos api.sonos.com through 2025-04-21, when the /login/v3/oauth endpoint is used, accepts a redirect_uri containing userinfo in the authority component, which is not consistent with RFC 6819 section 5.2.3.5. An authorization code may be sent to an attacker-controlled destination. This might…

more

have further implications in conjunction with "Decompiling the app revealed a hardcoded secret."

CWE(s)
CWE-647

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-64500Shared CWE-647
CVE-2025-47241Shared CWE-647
CVE-2025-9909Shared CWE-647
CVE-2026-5222Shared CWE-647
CVE-2022-43939Shared CWE-647
CVE-2025-66202Shared CWE-647
CVE-2026-59731Shared CWE-647
CVE-2026-8384Shared CWE-647
CVE-2026-62685Shared CWE-647

Affected Assets

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V2.2.1
  • V10.4.1

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Proper enforcement of authorization decisions requires canonical URL normalization before policy evaluation, directly stopping non-canonical bypasses.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing well-defined authorization policies prevents URL canonicalization bypasses when path handling is included in the implementation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can discover non-canonical URL bypasses but does not itself implement the preventive control.

A.8.26 Application security requirements partial match
prevents

Defining application security requirements that mandate canonical URL handling and authorization checks mitigates the weakness at design time.

A.8.28 Secure coding partial match
prevents

Secure-coding standards that require URL canonicalization and safe path handling eliminate the root cause of the weakness.

A.8.3 Information access restriction partial match
prevents

Enforcing strict access-control rules on canonical resource identifiers directly prevents authorization bypass via non-canonical URLs.

References