CVE-2025-66035

A logic error exists in Angular’s built-in XSRF protection causes the framework to misclassify protocol-relative URLs (i.e. URLs starting with “//”) as same-origin. As a result, the client automatically appends and sends the XSRF token in an X-XSRF-TOKEN header to the remote domain — potentially attacker-controlled — enabling unauthorized disclosure of the token and bypass of CSRF protection.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

By using protocol-relative URLs (URLs starting with //) in HttpClient requests and/or Disabling XSRF token attachment for non-same-origin requests using custom Angular interceptors, this vulnerability can be mitigated.