Angular XSRF token leak CVE-2025-66035 bypasses protection via URL parsing flaws
1. Executive summary An incomplete fix for CVE-2025-66035 in @angular/common leaves the xsrfInterceptorFn in the Angular HTTP Client attaching the X-XSRF-TOKEN
20 Oct 2026 · 7 min read
read →