What is the CVSS score of CVE-2026-44745?

CVE-2026-44745 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.3%.

Which versions of SAP Approuter are affected by CVE-2026-44745?

SAP Approuter, a critical authentication component for SAP Business Technology Platform (BTP) and Cloud Foundry environments, contains an OAuth2 login flow vulnerability that allows unauthenticated…. A patch is available.

How to fix or mitigate CVE-2026-44745?

Within 24 hours, identify all SAP Approuter instances in your environment and assess which business applications depend on them; notify application owners, security teams, and BTP platform administrators of the vulnerability. Within 7 days, implement compensating controls including strict OAuth2 redirect URI whitelisting per vendor guidelines, disabling or validating unnecessary HTTP header forwarding, network segmentation to restrict Approuter exposure to trusted networks only, and user awareness training on phishing and link-manipulation attacks. Within 30 days, establish a vendor-patch monitoring process for SAP security advisories, conduct phishing simulations targeting your user base to validate awareness effectiveness, and maintain an updated inventory of all Approuter configurations for rapid deployment once SAP releases a fix.

SAP Approuter CVE-2026-44745

EUVD-2026-43585 HIGH

URL Redirection to Untrusted Site (Open Redirect) (CWE-601)

2026-07-14 sap

GHSA-44p5-3m5g-vfhj

SAP Authentication Bypass Open Redirect Sap Approuter

8.1

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Network-reachable, low-complexity, unauthenticated open redirect in the OAuth2 flow requiring a victim click (UI:R); token/code theft yields high C and I, no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jul 14, 2026 - 05:17 EUVD

Analysis Generated

Jul 14, 2026 - 01:16 vuln.today

CVE Published

Jul 14, 2026 - 00:18 cve.org

HIGH 8.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

3 npm packages depend on @sap/approuter (3 direct, 0 indirect)

Ecosystem-wide dependent count for version 21.2.0.

DescriptionCVE.org

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application.

AnalysisAI

Unauthorized access in SAP Approuter arises because the component fails to validate incoming request headers during the OAuth2 login flow under certain configurations (CWE-601, open redirect). An unauthenticated remote attacker who lures a victim into clicking a crafted link can hijack the authentication flow to gain high-confidentiality and high-integrity access to the application. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV, but the network-reachable, low-complexity nature (CVSS 8.1) makes it a meaningful patch priority for SAP BTP/Cloud Foundry environments.

Technical ContextAI

SAP Approuter is the Node.js-based reverse-proxy/routing layer that fronts applications on the SAP Business Technology Platform (BTP) and Cloud Foundry, brokering the OAuth2/OpenID Connect login handshake between end users and SAP's XSUAA identity service. The flaw is classified as CWE-601 (URL Redirection to Untrusted Site / Open Redirect): during the OAuth2 login flow, Approuter trusts attacker-influenced request headers (typically host/redirect-style headers) instead of validating them against an allow-list, so the post-authentication redirect target can be steered off-domain. Because the affected step is the OAuth2 callback, a manipulated redirect can leak the authorization code or session artifacts, which is why the vendor rates confidentiality and integrity impact as High rather than treating it as a benign redirect. The single affected package per CPE is cpe:2.3:a:sap_se:sap_approuter, and the tags (Open Redirect, Authentication Bypass) reinforce that the redirect is being leveraged to subvert the auth handshake.

RemediationAI

Patch available per vendor advisory: apply the fix described in SAP Security Note 3741519 (https://me.sap.com/notes/3741519) and cross-check the SAP Security Patch Day page (https://url.sap/sapsecuritypatchday) for the exact patched Approuter release, then upgrade the @sap/approuter dependency to that version; the note lists the specific fixed version, which is not reproduced in the input data. Because the issue only manifests under 'certain configurations' of the OAuth2 login flow, review Approuter's redirect/login configuration and constrain redirect handling to an explicit allow-list of trusted hosts rather than trusting inbound headers - the trade-off is that overly strict allow-listing can break legitimate multi-tenant or custom-domain login redirects, so validate against your real login endpoints. As a compensating control until patched, front Approuter with a WAF or reverse proxy that strips or normalizes untrusted host/redirect headers and restrict who can reach the internet-facing login endpoint; note this adds an inspection layer that must itself be kept in sync with legitimate redirect targets.