Astro CVE-2025-66202

Requires the target to be an Astro SSR application running version <5.15.8 (per vendor data) whose middleware enforces authorization by comparing context.url.pathname against literal route strings (e.g. context.url.pathname === '/admin'), the exact pattern shown in Astro's official authentication documentation. The root cause is that Astro applies decodeURI() to resolve the route for rendering but the middleware reads the un-normalized raw pathname, so encoded path variants reach the page while evading the string equality check. Exploitation is unauthenticated and needs no user interaction. LIMITING FACTORS: static/prerendered sites and apps that do not perform pathname-based auth in middleware are unaffected; apps using framework-native or cookie/token-gated access controls independent of raw pathname matching are not vulnerable; the flaw grants access only to routes guarded by this specific middleware pattern, not arbitrary code execution.

This is a moderate-risk, conditionally-exploitable authentication bypass rather than a broad critical flaw. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N = 6.5 Medium) indicates a network-reachable, low-complexity, unauthenticated attack with limited confidentiality and integrity impact and no availability impact - consistent with gaining access to specific protected routes rather than full system compromise. EPSS is low at 0.31% (22nd percentile), the CVE is NOT on CISA KEV, and no public exploit is flagged in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. Crucially, exploitability is NOT universal: it only applies to Astro SSR applications whose developers implemented path-based authorization in middleware using context.url.pathname comparisons (e.g. the '/admin' pattern shown in Astro's own authentication docs), which tempers the PR:N network-vector signal. NOTE A DATA CONFLICT: the description states 'the original CVE-2025-64765 was fixed in v5.15.8' yet also says the current issue (a bypass of that insufficient fix) 'is fixed in version 5.15.8' and lists 'vulnerable < 5.15.8, fixed in 5.15.8' - this fixed-version labeling is internally contradictory and should be verified against the GHSA-whqg-ppgf-wp8c advisory, as the real fix may be a later patch (5.15.8+). The signals are otherwise consistent: low EPSS + no KEV + limited CVSS impact point to a genuine but non-emergency patch priority for teams running affected Astro middleware auth patterns.

An Astro SSR site protects /admin via middleware that redirects unless context.url.pathname equals '/admin'. An unauthenticated attacker requests a double/alternately URL-encoded variant (e.g. /%2561dmin or /%61%64%6d%69%6e); because Astro's routing layer decodes the path to resolve the /admin page while the middleware reads the still-encoded raw pathname, the equality check fails to match and the auth redirect is skipped, serving the protected admin content. No public exploit is identified at time of analysis, though the GHSA advisory includes a concrete bypass example, and the AV:N/AC:L vector makes the request trivial to craft.