EUVD-2026-22140Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a victim�s session. If the application continues to accept previously issued tokens after authentication, the attacker could assume the victim�s authenticated context. This could allow the attacker to access or modify information within the victim�s session scope, impacting confidentiality and integrity, while availability remains unaffected.
AnalysisAI
Insecure session management in SAP Business Objects Business Intelligence Platform allows unauthenticated attackers to obtain and reuse valid session tokens, enabling unauthorized access to victim sessions with moderate complexity. An attacker exploiting this vulnerability could access or modify information within the compromised session's scope, affecting confidentiality and integrity. The attack requires user interaction (UI:R) and high attack complexity (AC:H), limiting real-world exploitation but still warranting prioritized remediation for organizations running affected BI Platform versions.
Technical ContextAI
The vulnerability stems from inadequate session token validation mechanisms in SAP Business Objects Business Intelligence Platform, classified under CWE-539 (Use of Persistent Cookies Containing Sensitive Information). The root cause involves the application failing to invalidate or rotate session tokens after initial authentication, allowing previously issued tokens to remain valid indefinitely. This is a session management flaw rather than a cryptographic weakness-the platform does not properly implement token lifecycle controls, such as expiration enforcement, token reissue on re-authentication, or binding tokens to specific user contexts. An unauthenticated attacker can intercept, capture, or obtain valid session tokens (through interception, social engineering, or similar means) and replay them to assume an authenticated user's context without providing valid credentials.
RemediationAI
Apply the security patch released by SAP for this vulnerability by consulting SAP Note 3702191 and the SAP Security Patch Day advisories. Upgrade SAP Business Objects Business Intelligence Platform to the patched version specified in the vendor advisories (https://me.sap.com/notes/3702191 and https://url.sap/sapsecuritypatchday). As interim mitigating controls pending patching, implement strict session token lifecycle management by configuring aggressive token expiration policies, enforcing token invalidation upon user logout, and binding session tokens to additional context such as IP address or user-agent headers. Monitor session activity for token reuse patterns and implement multi-factor authentication (MFA) for BI Platform access to reduce the impact of session hijacking. Ensure secure token transmission over HTTPS and restrict token storage to secure, httpOnly cookies where applicable.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today