CVE-2025-66035
highpriority · track · 0EPSS 0.007 · 54 %ileDEEUNLUSEPSS · scored 2026-10-27
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedRUGGEDCOM RST2428P (6GK6242-6PA00)siemens_psirt
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/ - FixedSIDIS Primesiemens_psirt
Update to V4.0.800 or later version
- FixedSIDIS Primecisa_csaf_ot
Update to V4.0.800 or later version
- FixedRUGGEDCOM RST2428P (6GK6242-6PA00)cisa_csaf_ot
Update to V4.0 or later version
https://support.industry.siemens.com/cs/ww/en/view/110002573/
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 4.4–8.6
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (146)
Products and version ranges known to be affected.
advisories (8)
Vendor and ecosystem advisories describing this.
- NCSC-2026-0079Kwetsbaarheden verholpen in Siemens productenNL2026-03-10csaf · ncsc_nlNL
Siemens heeft kwetsbaarheden verholpen in diverse producten als Heliox, Ruggedcom, SICAM, SIDIS en SIMATIC.
- SSA-253495SSA-253495: Multiple Vulnerabilities in SINEC OS before V4.02026-06-02csaf · siemens_psirtDE
SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.
- SSA-485750SSA-485750: Multiple Vulnerabilities in SIDIS Prime Before V4.0.8002026-03-10csaf · siemens_psirtDE
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
- WID-SEC-W-2025-2689Angular: Schwachstelle ermöglicht Offenlegung von InformationenDeutsch2025-11-26csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Angular ausnutzen, um Informationen offenzulegen.
- WID-SEC-W-2026-0778Dell Secure Connect Gateway Policy Manager: Mehrere SchwachstellenDeutsch2026-03-18csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell Secure Connect Gateway Policy Manager ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
- GHSA-58c5-g7wp-6w37Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client2025-11-26ghsa · osvUS
The vulnerability is a **Credential Leak by App Logic** that leads to the **unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token** to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (`http://` or `https://`) to determine if it is cross-origin. If the URL starts with protocol-relative URL (`//`), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the `X-XSRF-TOKEN` header. ### Impact The token leakage completely bypasses Angular's built-in CSRF protection, allowing an attacker to capture the user's valid XSRF token. Once the token is obtained, the attacker can perform arbitrary Cross-Site Request Forgery (CSRF) attacks against the victim user's session. ### Attack Preconditions 1. The victim's Angular application must have **XSRF protection enabled**. 2. The attacker must be able to make the application send a state-changing HTTP request (e.g., `POST`) to a **protocol-relative URL** (e.g., `//attacker.com`) that they control. ### Patches - 19.2.16 - 20.3.14 - 21.0.1 ### Workarounds Developers should avoid using protocol-relative URLs (URLs starting with `//`) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single `/`) or fully qualified, trusted absolute URLs.
- ICSA-26-071-03Siemens SIDIS Prime2026-03-10icsa · cisa_csaf_otUS
SIDIS Prime before V4.0.800 is affected by multiple vulnerabilities in the components OpenSSL, SQLite, and several Node.js packages as described below. Siemens has released a new version of SIDIS Prime and recommends to update to the latest version.
- ICSA-26-188-05Siemens SINEC OS2026-06-02icsa · cisa_csaf_otUS
SINEC OS before V4.0 contains multiple vulnerabilities. Siemens has released a new version for RUGGEDCOM RST2428P and recommends to update to the latest version.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (25)
External citations — patches, advisories, analysis.
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516fcnnvd
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bccnnvd
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41ecnnvd
- https://github.com/angular/angular/releasesPatchcnnvd
- https://github.com/angular/angular/releases/tag/19.2.16cnnvd
- https://github.com/angular/angular/releases/tag/20.3.14cnnvd
- https://github.com/angular/angular/releases/tag/21.0.1cnnvd
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37cnnvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan