High severityGHSA Advisory· Published Aug 21, 2025· Updated Apr 15, 2026

CVE-2025-57755

Description

claude-code-router is a powerful tool to route Claude Code requests to different models and customize any request. Due to improper Cross-Origin Resource Sharing (CORS) configuration, there is a risk that user API Keys or equivalent credentials may be exposed to untrusted domains. Attackers could exploit this misconfiguration to steal credentials, abuse accounts, exhaust quotas, or access sensitive data. The issue has been patched in v1.0.34.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
@musistudio/claude-code-routernpm	< 1.0.34	1.0.34

Affected products

Musistudio/Claude Code RouterGHSA
Range: < 1.0.34
ghsa-coords
pkg:npm/%40musistudio/claude-code-router
Range: < 1.0.34

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-8hmm-4crw-vm2cghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-57755ghsaADVISORY
github.com/musistudio/claude-code-router/issues/549ghsaWEB
github.com/musistudio/claude-code-router/security/advisories/GHSA-8hmm-4crw-vm2cnvdWEB

News mentions

No linked articles in our index yet.

cvss	0.455
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000