CVE-2025-52882: Claude Code Improper Authorization via websocket connections from arbitrary origins
8.8
Basic Information
JavaScriptTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| @anthropic-ai/claude-code | npm | >= 0.2.116, < 1.0.24 | 1.0.24 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
I was unable to identify the vulnerable functions for this vulnerability. My attempts to retrieve commit information using repository tags and version comparison were unsuccessful, as the repository does not appear to use standard versioning tags that are accessible through the available tools. Without access to the specific commits that patched the vulnerability, I cannot analyze the code changes to pinpoint the exact functions responsible for the improper websocket authorization. The vulnerability lies in the lack of origin validation for websocket connections, but without the code, I cannot determine the function names or file paths. Further investigation would require manual review of the repository's commit history to find the security patch, which is beyond the scope of my current capabilities.