Improper CORS Configuration Vulnerability in Claude Code Router by Musistudio
CVE-2025-57755

8.1HIGH

Key Information:

Vendor

Musistudio

Status
Claude-code-router
Vendor
CVE Published:
21 August 2025

What is CVE-2025-57755?

The Claude Code Router tool allows customization and management of API requests. However, it suffers from a misconfigured Cross-Origin Resource Sharing (CORS) policy, potentially exposing user API keys and credentials to malicious domains. This misconfiguration can lead to unauthorized credential theft, account exploitation, and access to sensitive user data. A patch addressing this vulnerability has been released in version 1.0.34, urging users to update promptly to mitigate these risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

claude-code-router < 1.0.34

References

https://github.com/musistudio/claude-code-router/security...
x_refsource_CONFIRM

CVSS V4

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.