N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-57755

CVE-2025-57755: @musistudio/claude-code-router has improper CORS configuration

Impact

Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfiguration to steal credentials, abuse accounts, exhaust quotas, or access sensitive data.

Patches

The issue has been patched in v1.0.34.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-57755

CVE-2025-57755:

N/A

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
@musistudio/claude-code-router	npm	< 1.0.34	1.0.34

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

An analysis of the provided security advisory and related code changes reveals that the vulnerability stems from the removal of crucial access control checks and the introduction of flawed CORS logic. These changes occurred in commit cce162553498cacfcfd443f964149917521a7e92, which, contrary to its commit message, appears to have introduced the security flaw rather than fixing a bug.

The root cause of the vulnerability lies in two main areas:

Authentication Middleware (apiKeyAuth): The apiKeyAuth function in src/middleware/auth.ts was modified to remove a temporary API key authentication mechanism. The logic that replaced it was intended to handle CORS for local development but was implemented incorrectly. This function is central to protecting the application's endpoints.
Configuration Endpoints (createServer): Within the createServer function in src/server.ts, the access control checks for the /api/config GET and POST endpoints were completely removed. This allows any unauthenticated user to read and write sensitive configuration data, including API keys.

These modifications effectively expose sensitive configuration endpoints to unauthorized access, leading to the risk of credential theft and account abuse as described in the advisory.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

N/A

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2025-57755: @musistudio/claude-code-router has improper CORS configuration

Impact

Patches

CVE-2025-57755:

N/A

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Technical Details

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2025-57755: @musistudio/claude-code-router has improper CORS configuration

Impact

Patches

N/A

N/A

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI