EUVD-2026-55887
GHSA-397p-hh8q-gwmh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Aligns with vendor vector; network-reachable with no privilege or complexity barrier, victim click required, scope unchanged, integrity-only limited impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an attacker-controlled identity, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
AnalysisAI
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | All deployments of SAP Approuter Node.js package versions prior to 23.0.0 are affected by default, as CSRF protection on the authentication flow is not enforced unless manually configured. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 medium score is internally consistent: the network vector (AV:N) and low complexity (AC:L) indicate ease of reach, while the required user interaction (UI:R) and limited integrity-only impact (I:L, C:N, A:N) appropriately constrain the score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the SAP Approuter Node.js package to version 23.0.0 or later, which enforces CSRF protection on the authentication flow by default. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker t
Certificate validation bypass in SAP Approuter node.js package (versions prior to 23.0.0) enables a low-privileged netwo
Path traversal authorization bypass in SAP Approuter (Node.js package, versions prior to 23.0.0) enables a low-privilege
Denial-of-service in SAP Approuter (SAP Business AI Platform), the node.js routing and authentication gateway for SAP BT
Insufficient authorization enforcement in the WebSocket layer of SAP Approuter (node.js package < 23.0.0) allows a low-p
Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privil
Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attac
Unbounded memory growth in SAP Business AI Platform (Approuter) allows a low-privileged authenticated attacker to degrad
Improper error condition handling in SAP Approuter (the node.js routing component of SAP Business AI Platform) allows a
Tenant context spoofing in SAP Approuter (node.js package < 23.0.0) allows unauthenticated remote attackers to craft req
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today