SAP Approuter EUVD-2026-43585

Exploitation requires that SAP Approuter be running in one of the vulnerable 'certain configurations' of the OAuth2 login flow where incoming request headers are not validated - i.e., the OAuth2/XSUAA-backed login path must be enabled and reachable. The attack is unauthenticated (PR:N) and network-borne (AV:N), but is gated by required user interaction (UI:R): a victim with a valid session/identity must click the attacker's crafted link for the malicious redirect to fire. Limiting factors are therefore three-fold: the deployment must use the affected OAuth2 login configuration (not all Approuter setups qualify), the Approuter login endpoint must be reachable by the attacker's victim, and the attacker cannot succeed without social-engineering a user into clicking. It does not work against configurations that do not expose the affected header-trusting OAuth2 login behavior.

The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N (8.1, High) describes a network-reachable, low-complexity, unauthenticated attack whose single gating factor is user interaction - the victim must click the malicious link. No EPSS score was supplied, so exploitation probability cannot be quantified from the input, and the CVE is not in CISA KEV, so there is no evidence of active exploitation; the exploitation status is 'no public exploit identified at time of analysis.' The signals are internally consistent (no conflict between vector and description), but note the vendor scored Scope Unchanged (S:U) even though a stolen OAuth code can grant access to the fronted application - defenders may reasonably view the practical blast radius as broader than S:U implies. The dependence on UI:R and on 'certain configurations' means this is a real but conditional priority rather than a wormable, no-interaction critical: high value where Approuter is internet-facing and used for interactive OAuth2 logins, lower where it is internal-only or not using the affected login configuration.

An attacker crafts a link to a legitimate SAP Approuter-fronted application that embeds manipulated headers/parameters influencing the OAuth2 redirect, then delivers it to a targeted user via phishing email or chat. When the authenticated victim clicks the link and completes the OAuth2 login, Approuter redirects the flow (or leaks the authorization code) to an attacker-controlled destination, letting the attacker obtain unauthorized access to the application with the victim's context. No public proof-of-concept was identified in the provided data, and success depends on the low-complexity but user-interaction-gated conditions in the CVSS vector.