EUVD-2026-55887
GHSA-397p-hh8q-gwmh
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Aligns with vendor vector; network-reachable with no privilege or complexity barrier, victim click required, scope unchanged, integrity-only limited impact.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
Lifecycle Timeline
2DescriptionCVE.org
SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a victim into following it. Successful exploitation could allow the attacker to bind the victim's session to an attacker-controlled identity, resulting in a low impact on integrity. There is no impact on confidentiality and availability.
AnalysisAI
Login CSRF in SAP Approuter (SAP Business AI Platform, Node.js package < 23.0.0) allows an unauthenticated remote attacker to bind a victim's session to an attacker-controlled identity by tricking the victim into following a crafted link targeting the unprotected authentication flow. The missing CSRF enforcement is a default configuration gap, not a non-default edge case - all deployments running the affected package version are exposed unless they have manually enabled CSRF protection. No public exploit has been identified at time of analysis and no CISA KEV listing exists; EPSS data was not provided.
Technical ContextAI
SAP Approuter is a Node.js package (CPE: cpe:2.3:a:sap_se:sap_business_ai_platform_(approuter)) that acts as the single entry point for SAP Business Technology Platform (BTP) application routing, handling OAuth 2.0 / OIDC authentication flows on behalf of downstream microservices. CWE-352 (Cross-Site Request Forgery) describes the failure to validate that a state-changing request was intentionally initiated by the legitimate user's browser. In this specific instance the vulnerability is a Login CSRF (sometimes called session fixation via CSRF): because the Approuter does not validate a CSRF token during the authentication callback or initiation endpoint, an attacker can pre-craft or replay authentication flow requests. The CVSS vector AV:N/AC:L/PR:N/UI:R/S:U confirms the attack is network-reachable with no special complexity or privileges, but does require the victim to follow a malicious link. The scope remains unchanged (S:U), meaning the impact is confined to the vulnerable system's session context.
RemediationAI
Upgrade the SAP Approuter Node.js package to version 23.0.0 or later, which enforces CSRF protection on the authentication flow by default. The fix is documented in SAP Security Note 3786038 (https://me.sap.com/notes/3786038) and announced on SAP Security Patch Day (https://url.sap/sapsecuritypatchday). Where immediate package upgrade is not possible, a compensating control is to manually enable CSRF token validation in the Approuter configuration if the version supports it - consult the Approuter documentation for the csrf configuration option. Additionally, restricting the Approuter's authentication endpoints to trusted network segments or enforcing referrer/origin header validation at a reverse proxy layer can reduce exploitability, though these controls do not eliminate the root cause and may break legitimate deep-linking scenarios.
Token content validation bypass in SAP Approuter (node.js package < 23.0.0) enables an unauthenticated remote attacker t
Certificate validation bypass in SAP Approuter node.js package (versions prior to 23.0.0) enables a low-privileged netwo
Path traversal authorization bypass in SAP Approuter (Node.js package, versions prior to 23.0.0) enables a low-privilege
Denial-of-service in SAP Approuter (SAP Business AI Platform), the node.js routing and authentication gateway for SAP BT
Insufficient authorization enforcement in the WebSocket layer of SAP Approuter (node.js package < 23.0.0) allows a low-p
Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privil
Header injection in SAP Approuter (the Node.js package for SAP Business AI Platform) allows unauthenticated remote attac
Unbounded memory growth in SAP Business AI Platform (Approuter) allows a low-privileged authenticated attacker to degrad
Improper error condition handling in SAP Approuter (the node.js routing component of SAP Business AI Platform) allows a
Tenant context spoofing in SAP Approuter (node.js package < 23.0.0) allows unauthenticated remote attackers to craft req
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today