Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client

🗓️ 26 Nov 2025 23:18:50Reported by GitHub Advisory DatabaseType

Angular HttpClient leaks Cross-Site Request Forgery token via protocol relative URLs, bypassing protection.

Reporter	Title	Published	Views	Family All 25
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities related to Angular and JJWT have been fixed in IBM Informix HQ 3.2.2.	27 Apr 202606:31	–	ibm
IBM Security Bulletins	Security Bulletin: common-18.2.14.tgz, IBM Sterling Connect:Direct Web Services is affected by Credential Leak by App Logic that leads to the unauthorized disclosure.	2 Jun 202611:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Db2 Mirror for i is vulnerable to cross-site scripting and cross-site request forgery due to Angular [CVE-2025-66412, CVE-2026-22610, CVE-2025-66035]	20 Feb 202616:54	–	ibm
IBM Security Bulletins	Security Bulletin: IBM i is affected by Cross-Site Request Forgery and Cross-Site Scripting in Digital Certificate Manager and Navigator for i [CVE-2025-66035, CVE-2025-66412, CVE-2026-22610]	20 Feb 202616:42	–	ibm
Circl	CVE-2025-66035	26 Nov 202523:17	–	circl
CNNVD	Angular 安全漏洞	26 Nov 202500:00	–	cnnvd
CVE	CVE-2025-66035	26 Nov 202522:18	–	cve
Cvelist	CVE-2025-66035 Angular HTTP Client Has XSRF Token Leakage via Protocol-Relative URLs	26 Nov 202522:18	–	cvelist
Debian CVE	CVE-2025-66035	26 Nov 202522:18	–	debiancve
EUVD	EUVD-2025-199769	26 Nov 202522:18	–	euvd

Vulners

Node

angular commonRange<19.2.16npm

angular commonRange20.0.0-next.0–20.3.14npm

angular commonRange21.0.0-next.0–21.0.1npm

Source	Link
github	www.github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37
github	www.github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f
github	www.github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc
github	www.github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e
github	www.github.com/angular/angular/releases/tag/19.2.16
github	www.github.com/angular/angular/releases/tag/20.3.14
github	www.github.com/angular/angular/releases/tag/21.0.1
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-66035
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-253495.html
cert-portal	www.cert-portal.siemens.com/productcert/html/ssa-485750.html

09 Jun 2026 10:55Current

6.9Medium risk

Vulners AI Score6.9

CVSS 47.7

EPSS0.00601

SSVC