SAP Approuter CVE-2026-66775

All deployments of SAP Approuter Node.js package versions prior to 23.0.0 are affected by default, as CSRF protection on the authentication flow is not enforced unless manually configured. The attacker requires no authentication and no special privileges (PR:N per CVSS), but must successfully trick the victim into clicking a crafted link (UI:R), making social engineering or phishing a hard prerequisite. The victim does not need to be previously authenticated; the attack targets the login/authentication initiation flow itself. Exploitation is strictly bounded to an integrity impact - specifically, session binding to an attacker-controlled identity - with no confidentiality or availability consequences. Deployments where CSRF protection has been explicitly enabled in the Approuter configuration prior to upgrading are not vulnerable. Deployments isolated from external users (internal enterprise portals with no external link delivery vector) face negligible realistic risk.

The CVSS 4.3 medium score is internally consistent: the network vector (AV:N) and low complexity (AC:L) indicate ease of reach, while the required user interaction (UI:R) and limited integrity-only impact (I:L, C:N, A:N) appropriately constrain the score. No EPSS score was provided in the intelligence data, so exploitation probability cannot be quantified. The absence from CISA KEV and lack of any reported POC suggest this is not being actively mass-exploited at time of analysis. The practical risk is highest in public-facing SAP BTP deployments where external users receive links from untrusted parties, as the attack depends entirely on social engineering. Internal-only deployments with controlled user populations face significantly lower realistic risk despite the same CVSS score. No conflicting signals were detected - the CVSS vector, description, and CWE are coherent.

An attacker identifies a public-facing SAP BTP application whose Approuter component is running a version prior to 23.0.0, then crafts a malicious URL pointing to the Approuter's authentication initiation or callback endpoint with manipulated OAuth state or identity parameters under the attacker's control. The attacker delivers this link to a target user via phishing email or a compromised web page; when the victim clicks the link and completes the authentication interaction, their session becomes bound to the attacker-controlled identity, giving the attacker indirect influence over the victim's application session. No public proof-of-concept has been reported, but the Login CSRF attack pattern against OAuth flows is well-documented and reproducible by a moderately skilled attacker.