CVE-2025-66202— Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

使用未经净化的URL路径进行授权决策

Astro 安全漏洞

Astro是Astro开源的一个内容驱动网站的 web 框架。 Astro 5.15.7及以下版本存在安全漏洞，该漏洞源于双重URL编码绕过，可能导致未经验证的攻击者访问受保护路由。

N/A

N/A