{"id":"CVE-2025-66035","aliases":["GHSA-58c5-g7wp-6w37"],"url":"https://o3.security/vulnerability/CVE-2025-66035","summary":"Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs","details":"The vulnerability is a **Credential Leak by App Logic** that leads to the **unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token** to an attacker-controlled domain.\n\nAngular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (`http://` or `https://`) to determine if it is cross-origin. If the URL starts with protocol-relative URL (`//`), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the `X-XSRF-TOKEN` header.\n\n### Impact\nThe token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session.\n\n### Attack Preconditions\n1. The victim's Angular application must have **XSRF protection enabled**.  \n2. The attacker must be able to make the application send a state-changing HTTP request (e.g., `POST`) to a **protocol-relative URL**  (e.g., `//attacker.com`) that they control.\n\n### Patches\n- 19.2.16\n- 20.3.14\n- 21.0.1\n\n### Workarounds\nDevelopers should avoid using protocol-relative URLs (URLs starting with `//`) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single `/`) or fully qualified, trusted absolute URLs.","published":"2025-11-26T22:18:35.692Z","modified":"2026-08-12T03:51:24.208260316Z","cvss":null,"epss":{"score":0.00659,"percentile":0.49932,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"@angular/common","fixedVersion":"21.0.1"},{"ecosystem":"npm","name":"@angular/common","fixedVersion":"20.3.14"},{"ecosystem":"npm","name":"@angular/common","fixedVersion":"19.2.16"}],"fix":{"url":"https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f","label":"angular/angular@0276479"},"references":[{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-253495.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-485750.html"},{"type":"WEB","url":"https://github.com/angular/angular/releases/tag/19.2.16"},{"type":"WEB","url":"https://github.com/angular/angular/releases/tag/20.3.14"},{"type":"WEB","url":"https://github.com/angular/angular/releases/tag/21.0.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/66xxx/CVE-2025-66035.json"},{"type":"ADVISORY","url":"https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-66035"},{"type":"FIX","url":"https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f"},{"type":"FIX","url":"https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc"},{"type":"FIX","url":"https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e"},{"type":"PACKAGE","url":"https://github.com/angular/angular"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:24.208260316Z"}}