EUVD-2026-55888
GHSA-2x68-8jqv-5gp3
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Network-accessible Approuter requires prior session observation (AC:H) and a valid low-privilege account (PR:L); no scope change or availability impact applies.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
AnalysisAI
Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privilege attacker to hijack another user's session by sending crafted requests that circumvent header integrity verification on certain code paths. Exploitation demands prior out-of-band observation of the target's session values, constraining this to determined, targeted attackers rather than opportunistic mass exploitation. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to hold at least a low-privilege authenticated account on the SAP Business AI Platform Approuter instance, as confirmed by PR:L in the CVSS vector - unauthenticated external access is not sufficient. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.9 (Medium) vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N accurately reflects a genuinely constrained threat: the AC:H rating is substantive here, not nominal, because exploitation requires prior out-of-band acquisition of a target user's session values before any bypass attempt - an attacker cannot simply scan and exploit at scale. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade the SAP Approuter node.js package to version 23.0.0 or later, as indicated by the EUVD affected-version boundary and confirmed by the vendor patch availability status; the fix details are documented in SAP Security Note 3786038 at https://me.sap.com/notes/3786038 and the SAP Security Patch Day release at https://url.sap/sapsecuritypatchday. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Jwt Attack
View allWhy is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update
Authentication bypass in SimpleHelp 5.5.15 and prior (plus 6.0 pre-release builds) allows remote unauthenticated attacke
Authentication bypass in Fortinet FortiOS, FortiProxy, and FortiSwitchManager allows unauthenticated remote attackers to
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Rated critical severity (CVS
The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT
A library injection vulnerability exists in Microsoft Teams (work or school) 24046.2813.2770.1094 for macOS. Rated criti
A library injection vulnerability exists in the WebView.app helper app of Microsoft Teams (work or school) 24046.2813.27
A library injection vulnerability exists in the com.microsoft.teams2.modulehost.app helper app of Microsoft Teams (work
The Ruby SAML library is for implementing the client side of a SAML authorization. Rated critical severity (CVSS 9.8), t
cosign is a container signing and verification utility. Rated critical severity (CVSS 9.8), this vulnerability is remote
Biscuit is an authentication and authorization token for microservices architectures. Rated critical severity (CVSS 9.8)
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today