EUVD-2025-199769Published

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in …

Exact source revision recorded 30 Oct 2026 00:58:50 UTC. It does not establish the source's current position. Latest evidence.

Recorded JSON

euvd · EUVD-2025-199769

Published

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.

EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.

Original publisher date fields

datePublished: Nov 26, 2025, 10:18:35 PM

dateUpdated: Jun 2, 2026, 1:00:29 PM

6 related source bulletins · separate from aliases

SSA-253495: SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.0

CVE-2025-1352 · CVE-2025-1376 · CVE-2025-6052 · CVE-2025-6141 · CVE-2025-6170 · CVE-2025-7039 · CVE-2025-8732 · CVE-2025-9086 · CVE-2025-9230 · CVE-2025-9231 · CVE-2025-9232 · CVE-2025-10966 · CVE-2025-13465 · CVE-2025-13601 · CVE-2025-39913 · CVE-2025-40214 · CVE-2025-40248 · CVE-2025-40250 · CVE-2025-40251 · CVE-2025-40252 · CVE-2025-40254 · CVE-2025-40257 · CVE-2025-40258 · CVE-2025-40261 · CVE-2025-40262 · CVE-2025-40263 · CVE-2025-40264 · CVE-2025-40271 · CVE-2025-40278 · CVE-2025-40280 · CVE-2025-40281 · CVE-2025-40345 · CVE-2025-46394 · CVE-2025-49794 · CVE-2025-49795 · CVE-2025-49796 · CVE-2025-60876 · CVE-2025-66035 · CVE-2025-66382 · CVE-2025-66412 · CVE-2025-69720 · CVE-2025-71185 · CVE-2025-71186 · CVE-2025-71188 · CVE-2025-71189 · CVE-2025-71190 · CVE-2025-71191 · CVE-2026-1484 · CVE-2026-1489 · CVE-2026-3784 · CVE-2026-22610 · CVE-2026-22976 · CVE-2026-22977 · CVE-2026-23025 · CVE-2026-23026 · CVE-2026-23030 · CVE-2026-23031 · CVE-2026-23032 · CVE-2026-23033 · CVE-2026-23037 · CVE-2026-23038 · CVE-2026-23111 · CVE-2026-23112 · CVE-2026-23220 · CVE-2026-23222 · CVE-2026-23228 · CVE-2026-23229 · CVE-2026-23230 · CVE-2026-23231 · CVE-2026-23236 · CVE-2026-23238 · CVE-2026-24515 · CVE-2026-25210 · CVE-2026-26157 · CVE-2026-26158 · CVE-2026-35535 · CVE-2026-41918

ICSA-26-188-05: Siemens SINEC OS

ICSA-26-071-03: Siemens SIDIS Prime

NCSC-2026-0079: Kwetsbaarheden verholpen in Siemens producten

CVE-2024-29857 · CVE-2024-30171 · CVE-2024-30172 · CVE-2024-41996 · CVE-2025-6965 · CVE-2025-7783 · CVE-2025-9230 · CVE-2025-9232 · CVE-2025-9670 · CVE-2025-12816 · CVE-2025-15284 · CVE-2025-27769 · CVE-2025-40943 · CVE-2025-55018 · CVE-2025-58751 · CVE-2025-58752 · CVE-2025-58754 · CVE-2025-62439 · CVE-2025-62522 · CVE-2025-64157 · CVE-2025-64718 · CVE-2025-64756 · CVE-2025-66030 · CVE-2025-66031 · CVE-2025-66035 · CVE-2025-66412 · CVE-2025-69277 · CVE-2026-22610 · CVE-2026-24858 · CVE-2026-25569 · CVE-2026-25570 · CVE-2026-25571 · CVE-2026-25572 · CVE-2026-25573 · CVE-2026-25605

RHSA-2026:86618: Red Hat Security Advisory: New container image: rhceph-9.2

CVE-2023-46159 · CVE-2024-47866 · CVE-2024-48916 · CVE-2024-55565 · CVE-2025-12816 · CVE-2025-15599 · CVE-2025-26791 · CVE-2025-30156 · CVE-2025-50181 · CVE-2025-50182 · CVE-2025-58754 · CVE-2025-59343 · CVE-2025-62718 · CVE-2025-66030 · CVE-2025-66035 · CVE-2025-66412 · CVE-2025-69873 · CVE-2026-0540 · CVE-2026-21441 · CVE-2026-22610 · CVE-2026-25639 · CVE-2026-26996 · CVE-2026-27903 · CVE-2026-27904 · CVE-2026-27970 · CVE-2026-32141 · CVE-2026-33228 · CVE-2026-33671 · CVE-2026-33672 · CVE-2026-33891 · CVE-2026-33894 · CVE-2026-33895 · CVE-2026-33896 · CVE-2026-39865 · CVE-2026-40175 · CVE-2026-40895 · CVE-2026-41238 · CVE-2026-41239 · CVE-2026-41240 · CVE-2026-41305 · CVE-2026-42033 · CVE-2026-42034 · CVE-2026-42035 · CVE-2026-42036 · CVE-2026-42037 · CVE-2026-42038 · CVE-2026-42039 · CVE-2026-42040 · CVE-2026-42041 · CVE-2026-42042 · CVE-2026-42043 · CVE-2026-42044 · CVE-2026-50152 · CVE-2026-58224

SSA-485750: SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.800

Source published: Nov 26, 2025, 10:18:35 PM (timezone not stated)
Source modified: Jun 2, 2026, 1:00:29 PM (timezone not stated)
Observed here: 30 Oct 2026 00:58:50 UTC
Source terms: ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 7.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N