CVE-2025-66202

CVE-2025-66202 is a double URL encoding bypass vulnerability affecting Astro web framework versions 5.15.7 and below. This flaw allows unauthenticated attackers to bypass path-based authentication checks in Astro middleware, gaining unauthorized access to protected routes. The vulnerability has a CVSS score of 6.5 (Medium), indicating a network-based attack with low complexity, requiring no privileges or user interaction, and potentially leading to limited confidentiality and integrity impacts. While a previous fix was insufficient, this issue is resolved in Astro version 5.15.8. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.