What is CVE-2025-66200?

CVE-2025-66200 is a medium-severity vulnerability in Apache Http Server, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 5.4/10. Published 2025-12-05.

How severe is CVE-2025-66200?

Medium severity. CVSS v3 base score is 5.4 out of 10.

Vulnerability in Apache Http Server

CVE-2025-66200

mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

EPSS: 0.006 (44.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L.

Affected products

Apache Http_server
Apache Software Foundation Http Server — versions 2.4.7

Weakness classification (CWE)

CWE-288 — Authentication Bypass Using an Alternate Path or Channel

References

security@apache.org (vendor-advisory, Vendor Advisory)
af854a3a-2127-422b-91ae-364da2661108 (Issue Tracking, Third Party Advisory)

Frequently asked questions

What is CVE-2025-66200?: CVE-2025-66200 is a medium-severity vulnerability in Apache Http Server, classified under Authentication Bypass Using an Alternate Path or Channel. CVSS score: 5.4/10. Published 2025-12-05.
How severe is CVE-2025-66200?: Medium severity. CVSS v3 base score is 5.4 out of 10.