CVE-2025-66035 Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs
- Published
- Updated
- Exploit status
- No public exploit known
Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to versions 19.2.16, 20.3.14, and 21.0.1, there is a XSRF token leakage via protocol-relative URLs in angular HTTP clients. The vulnerability is a Credential Leak by App Logic that leads to the unauthorized disclosure of the Cross-Site Request Forgery (XSRF) token to an attacker-controlled domain. Angular's HttpClient has a built-in XSRF protection mechanism that works by checking if a request URL starts with a protocol (http:// or https://) to determine if it is cross-origin. If the URL starts with protocol-relative URL (//), it is incorrectly treated as a same-origin request, and the XSRF token is automatically added to the X-XSRF-TOKEN header. This issue has been patched in versions 19.2.16, 20.3.14, and 21.0.1. A workaround for this issue involves avoiding using protocol-relative URLs (URLs starting with //) in HttpClient requests. All backend communication URLs should be hardcoded as relative paths (starting with a single /) or fully qualified, trusted absolute URLs.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/angular.js(Debian:11) | All versions | No fix listed |
| debian/angular.js(Debian:11) | = 1.8.2-2 | No fix listed |
| debian/angular.js(Debian:11) | = 1.8.3-1 | No fix listed |
| debian/angular.js(Debian:11) | = 1.8.3-2 | No fix listed |
| debian/angular.js(Debian:11) | = 1.8.3-3 | No fix listed |
| debian/angular.js(Debian:12) | All versions | No fix listed |
| debian/angular.js(Debian:12) | = 1.8.3-1 | No fix listed |
| debian/angular.js(Debian:12) | = 1.8.3-1+deb12u1 | No fix listed |
| debian/angular.js(Debian:12) | = 1.8.3-1+deb12u1~deb11u1 | No fix listed |
| debian/angular.js(Debian:12) | = 1.8.3-2 | No fix listed |
| debian/angular.js(Debian:12) | = 1.8.3-3 | No fix listed |
| debian/angular.js(Debian:13) | All versions | No fix listed |
| debian/angular.js(Debian:13) | = 1.8.3-3 | No fix listed |
| debian/angular.js(Debian:14) | All versions | No fix listed |
| debian/angular.js(Debian:14) | = 1.8.3-3 | No fix listed |
| angular common(npm) | >= 21.0.0-next.0, < 21.0.1 | 21.0.1 |
| angular common(npm) | >= 20.0.0-next.0, < 20.3.14 | 20.3.14 |
| angular common(npm) | < 19.2.16 | 19.2.16 |
| angular | = >= 21.0.0-next.0, < 21.0.1 | No fix listed |
| angular | = >= 20.0.0-next.0, < 20.3.14 | No fix listed |
| angular | = < 19.2.16 | No fix listed |
| Siemens RUGGEDCOM RST2428P | < V4.0 | V4.0 |
| Siemens SIDIS Prime | < V4.0.800 | V4.0.800 |
| ubuntu/angular.js(Ubuntu:22.04) | All versions | No fix listed |
| redhat/rhceph/rhceph-9-rhel10:1790843527(Red Hat:ceph_storage:9.2::el10) | All versions | No fix listed |
Show 23 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat/openshift-logging/kibana6-rhel8(Red Hat:logging:5) | All versions | No fix listed |
| redhat/ceph(Red Hat:ceph_storage:4) | All versions | No fix listed |
| redhat/ceph(Red Hat:ceph_storage:5) | All versions | No fix listed |
| redhat/ceph(Red Hat:ceph_storage:6) | All versions | No fix listed |
| redhat/ceph(Red Hat:ceph_storage:7) | All versions | No fix listed |
| redhat/ceph(Red Hat:ceph_storage:8) | All versions | No fix listed |
| redhat/ceph(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/gjs(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/intel-cmt-cat(Red Hat:enterprise_linux:10) | All versions | No fix listed |
| redhat/intel-cmt-cat(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/mozjs60(Red Hat:enterprise_linux:8) | All versions | No fix listed |
| redhat/ceph(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/gjs(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/intel-cmt-cat(Red Hat:enterprise_linux:9) | All versions | No fix listed |
| redhat/io.apicurio-apicurito(Red Hat:jboss_fuse:7) | All versions | No fix listed |
| redhat/io.hawt-hawtio-integration(Red Hat:jboss_fuse:7) | All versions | No fix listed |
| redhat/io.hawt-hawtio-online(Red Hat:jboss_fuse:7) | All versions | No fix listed |
| redhat/io.hawt-project(Red Hat:jboss_fuse:7) | All versions | No fix listed |
| redhat/io.syndesis-syndesis-parent(Red Hat:jboss_fuse:7) | All versions | No fix listed |
| redhat/org.keycloak-keycloak-parent(Red Hat:red_hat_single_sign_on:7) | All versions | No fix listed |
| ubuntu/angular.js(Ubuntu:24.04) | All versions | No fix listed |
| ubuntu/angular.js(Ubuntu:26.04) | All versions | No fix listed |
| ubuntu/angular.js(Ubuntu:26.10) | All versions | No fix listed |
References
- Debian Security Tracker CVE-2025-66035 vendor-advisory
- https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37 vendor-advisory
- https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f patch
- https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc patch
- https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e patch
- https://github.com/angular/angular/releases/tag/19.2.16
- https://github.com/angular/angular/releases/tag/20.3.14
- https://github.com/angular/angular/releases/tag/21.0.1
- nvd.nist.gov third-party-advisory
- cert-portal.siemens.com
- cert-portal.siemens.com
- github.com
- Ubuntu CVE tracker vendor-advisory
- www.cve.org
- Red Hat CVE page mitigation vendor-advisory
- RHSA-2026:86618 patch vendor-advisory
- Red Hat Bugzilla 2417389 issue-tracking