What is the CVSS score of EUVD-2026-55888?

EUVD-2026-55888 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for EUVD-2026-55888?

Yes, a patch is available for EUVD-2026-55888. Update the affected software to the latest version immediately.

SAP Approuter EUVD-2026-55888

| CVE-2026-66776 MEDIUM

Improper Verification of Cryptographic Signature (CWE-347)

2026-08-11 sap

GHSA-2x68-8jqv-5gp3

Authentication Bypass SAP Jwt Attack Sap Business Ai Platform Approuter Sap Se

5.9

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

5.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

vuln.today AI

5.9 MEDIUM

Network-accessible Approuter requires prior session observation (AC:H) and a valid low-privilege account (PR:L); no scope change or availability impact applies.

3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 11, 2026 - 01:13 vuln.today

Patch available

Aug 11, 2026 - 01:02 EUVD

DescriptionCVE.org

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

AnalysisAI

Session integrity bypass in SAP Approuter (node.js package versions prior to 23.0.0) enables an authenticated low-privilege attacker to hijack another user's session by sending crafted requests that circumvent header integrity verification on certain code paths. Exploitation demands prior out-of-band observation of the target's session values, constraining this to determined, targeted attackers rather than opportunistic mass exploitation. No public exploit code and no CISA KEV listing identified at time of analysis, but successful exploitation yields full read access to the victim's session context with a high confidentiality impact per CVSS.

Technical ContextAI

SAP Approuter is a node.js package that functions as the single entry-point gateway for SAP Business AI Platform applications, managing authentication flows, session state, and request routing to backend microservices. CWE-347 (Improper Verification of Cryptographic Signature) identifies the root cause as a failure to consistently apply cryptographic integrity checks - the JWT Attack tag in the intelligence data strongly suggests this manifests as selective or conditional JWT signature validation, where specific request patterns or code paths bypass the token verification logic entirely. The CPE string (cpe:2.3:a:sap_se:sap_business_ai_platform_(approuter):*:*:*:*:*:*:*:*) confirms the affected component is the SAP SE-maintained Approuter package. The phrase 'under specific conditions' in the description implies a conditional branch in the validation logic rather than a universal omission, meaning only certain session-related header combinations trigger the vulnerable code path.

RemediationAI

Upgrade the SAP Approuter node.js package to version 23.0.0 or later, as indicated by the EUVD affected-version boundary and confirmed by the vendor patch availability status; the fix details are documented in SAP Security Note 3786038 at https://me.sap.com/notes/3786038 and the SAP Security Patch Day release at https://url.sap/sapsecuritypatchday. If an immediate upgrade cannot be scheduled, consider restricting network access to the Approuter endpoints to trusted internal segments or VPN-gated clients, reducing the pool of authenticated low-privilege users who could reach the vulnerable path - note this trades off external user accessibility. Additionally, deploying JWT validation enforcement at a reverse-proxy or API gateway layer ahead of the Approuter may provide a partial compensating control, though care is needed to ensure the proxy's validation covers the same header fields the Approuter inconsistently checks, and this approach requires testing to avoid breaking legitimate traffic. No vendor-documented workarounds beyond patching are confirmed in the available references.