CVE-2025-66202 - CVE House
Back to Database
Status published Medium CVE-2025-66202

Astro has an Authentication Bypass via Double URL Encoding, a bypass for CVE-2025-64765

Vulnerability Description

Astro is a web framework. Versions 5.15.7 and below have a double URL encoding bypass which allows any unauthenticated attacker to bypass path-based authentication checks in Astro middleware, granting unauthorized access to protected routes. While the original CVE-2025-64765 was fixed in v5.15.8, the fix is insufficient as it only decodes once. By using double-encoded URLs, attackers can still bypass authentication and access any route protected by middleware pathname checks. This issue is fixed in version 5.15.8.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-66202

Credits & Attribution

No credits recorded in the NVD database.

References

More from withastro

View All →
CVE-2025-65019
Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint
Medium 5.4
CVE-2025-64765
Astro middleware authentication checks based on url.pathname can be bypassed via url encoded values
Medium 6.9
CVE-2025-64764
Astro is vulnerable to Reflected XSS via the server islands feature
High 7.1
CVE-2025-64757
Astro Development Server is Vulnerable to Arbitrary Local File Read
Low 3.5
CVE-2025-64745
Astro development server error page vulnerable to reflected Cross-site Scripting
Low 2.7

Affected Vendor

Affected Software

astro
Vulnerable Versions:
< 5.15.8

Timeline

Official Publish: December 8th, 2025
Last Modified: December 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-647

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.