{"id":"EUVD-2025-201717","revision":"070f9fed9b7e472f96bf4618c78d2959","records":[{"revision":"070f9fed9b7e472f96bf4618c78d2959","observedAt":"2026-11-03T02:09:23.573+00:00","statement":{"source":"euvd","id":"EUVD-2025-201717","aliases":["CVE-2025-66202","GHSA-whqg-ppgf-wp8c"],"title":"Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes…","description":"Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","score":6.5,"severity":null}],"references":["https://github.com/withastro/astro/security/advisories/GHSA-whqg-ppgf-wp8c","https://github.com/withastro/astro/security/advisories/GHSA-ggxq-hp9w-j794","https://github.com/withastro/astro/commit/6f800813516b07bbe12c666a92937525fddb58ce"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201717","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 8, 2025, 11:41:21 PM","dateUpdated":"Dec 9, 2025, 4:04:07 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-201717","identifiers":["EUVD-2025-201717","CVE-2025-66202","GHSA-whqg-ppgf-wp8c"]},"retained":false,"historicalAffected":[]}],"coverage":[]}