EUVD-2026-55885
GHSA-wj2g-hp6v-8wj4
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N
Network vector confirmed; AC:H because exploitation requires attacker-controlled OData endpoint; PR:L reflects authenticated OData session; C:H for credential disclosure, I:L for data injection, A:N confirmed.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability.
AnalysisAI
Open redirect exploitation in SAP's python-pyodata library (versions before 1.11.2) allows a malicious or compromised OData service to capture sensitive authentication information transmitted by the client and inject untrusted data into the consuming application. Applications using pyodata that connect to externally controlled or attacker-reachable OData endpoints are at risk of credential disclosure and data integrity compromise. No public exploit code has been identified at time of analysis, and the vulnerability has not been listed in CISA KEV, but a vendor-released patch is available at version 1.11.2.
Technical ContextAI
The affected component is SAP's open-source Python OData client library, pyodata (pip package), versions prior to 1.11.2, identified via CPE cpe:2.3:a:sap_se:odata:*:*:*:*:*:*:*:*. OData (Open Data Protocol) is a REST-based protocol for querying and updating data; pyodata acts as a client that sends authenticated requests to OData service endpoints. CWE-601 (URL Redirection to Untrusted Site / Open Redirect) is the root cause class, indicating that pyodata fails to validate or restrict the OData service URL it communicates with. When a client library follows redirects without checking trust boundaries, authentication headers (e.g., Bearer tokens, Basic credentials) can be forwarded to an attacker-controlled destination. The data injection angle suggests the library also insufficiently validates responses returned by the OData service, allowing malicious payloads to enter application logic.
RemediationAI
The primary fix is to upgrade pyodata to version 1.11.2 or later via pip: 'pip install --upgrade pyodata>=1.11.2'. The patch is vendor-confirmed and tracked in the GitHub security advisory GHSA-hc5j-q32w-c25v at https://github.com/SAP/python-pyodata/security/advisories/GHSA-hc5j-q32w-c25v. If immediate upgrading is not feasible, a compensating control is to restrict pyodata's OData service base URLs to a hardcoded allowlist of trusted, internally controlled endpoints within your application code, preventing the library from connecting to any external or untrusted OData service. Additionally, ensure that authentication credentials passed to pyodata (e.g., OAuth tokens, API keys) are scoped with least privilege so that disclosure of those credentials limits the blast radius. Note that restricting URLs at the application layer does not patch the underlying library flaw and should be treated as a temporary measure only.
More in Open Redirect
View allA malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL ca
GFI Kerio Control versions 9.2.5 through 9.4.5 contain an HTTP response splitting vulnerability in the dest parameter of
PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect
Multiple open redirect vulnerabilities in Apache Struts 2.0.0 through 2.3.15 allow remote attackers to redirect users to
Open redirect vulnerability in age-verification.php in the Age Verification plugin 0.4 and earlier for WordPress allows
Open redirect vulnerability in Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.29, 8.x before 8.0.0.18, 9.0 b
Vulnerability in the Oracle Applications Framework component of Oracle E-Business Suite (subcomponent: Popup windows (li
Unspecified vulnerability in the Oracle Application Server Single Sign-On component in Oracle Fusion Middleware 10.1.4.3
Flarum is open source discussion platform software. Rated medium severity (CVSS 6.5), this vulnerability is remotely exp
Open redirect vulnerability in Novius OS 5.0.1 (Elche) allows remote attackers to redirect users to arbitrary web sites
Open redirect vulnerability in the Redirect function in stageshow_redirect.php in the StageShow plugin before 5.0.9 for
Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. Rated crit
Share
External POC / Exploit Code
Leaving vuln.today