EUVD-2026-55866
GHSA-vhh6-v828-x62f
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
Network-reachable with no authentication needed, but AC:H reflects mandatory non-default configuration prerequisite; C:H justified by credential exfiltration; I:L and A:L align with vendor assessment.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
3Blast Radius
ecosystem impact- 2 npm packages depend on @sap/approuter (2 direct, 0 indirect)
Ecosystem-wide dependent count for version 23.0.0.
DescriptionCVE.org
SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality and a low impact on integrity and availability.
AnalysisAI
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker to exfiltrate sensitive credential material to an attacker-controlled destination by submitting a specially crafted token. The flaw, classified as CWE-601 (Open Redirect), exploits insufficient URL or destination validation within the Approuter's token-processing logic under specific non-default configurations, yielding high confidentiality impact and low integrity and availability impact. No public exploit or active exploitation is confirmed at time of analysis; vendor patch is available via SAP Approuter 23.0.0 per SAP Security Note 3786038.
Technical ContextAI
SAP Approuter is the central request-routing and authentication-proxying component of the SAP Business Technology Platform (BTP) application layer, delivered as a node.js package. It handles OAuth 2.0 token flows, session management, and forwarding of requests to backend microservices, placing it at the authentication perimeter of BTP applications. The affected CPE is cpe:2.3:a:sap_se:sap_business_ai_platform_(approuter):*:*:*:*:*:*:*:*. CWE-601 (URL Redirection to Untrusted Site) is the root-cause class; the Approuter fails to adequately validate a URL or redirect destination embedded within or associated with incoming token content, allowing that content to steer outbound credential material toward an external attacker-controlled endpoint. Critically, this is a server-side variant of open redirect: the Approuter itself initiates an outbound connection carrying sensitive credentials rather than redirecting a victim's browser, eliminating any user-interaction requirement and making the impact more direct than a classic client-side open redirect.
RemediationAI
The primary remediation is to upgrade the SAP Approuter node.js package to version 23.0.0 or later, as all versions below this threshold are confirmed affected. The patch is documented in SAP Security Note 3786038, accessible via the SAP Support Portal at https://me.sap.com/notes/3786038; administrators should review that note for any additional guidance on upgrade sequencing or compatibility considerations. As an interim compensating control where immediate upgrading is not feasible, organizations should audit their Approuter configurations to identify and disable or restrict any non-default settings that enable the vulnerable token-handling code path - the exact configuration parameter is not publicly disclosed and should be clarified directly with SAP Support to avoid misapplication. An additional network-layer control is to restrict outbound connections from Approuter instances to a strict allowlist of known SAP and trusted service endpoints, which would prevent credential material from reaching attacker-controlled infrastructure even if the vulnerability were triggered; this restriction should be validated in a staging environment as it may affect Approuter routing functionality. Patch status is confirmed as available per vendor advisory; the exact fix version (23.0.0) is confirmed by the ENISA EUVD affected-versions listing.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today