CVE-2026-44745 | SAP Approuter does not properly validate incoming request he… | CVSS 8.1 HIGH

Description

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application.

Metadata

CVE ID: CVE-2026-44745
State: PUBLISHED
Assigner: sap
Reserved: 2026-05-07 18:16 UTC
Published: 2026-07-14 00:18 UTC
Last updated: 2026-07-14 00:18 UTC
Primary CWE: CWE-601
CWE-601: URL Redirection to Untrusted Site
Vendor / Product: SAP_SE / SAP Approuter
Sources: cve.org · NVD

Severity & Metrics

8.1 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Affected products (1)

Vendor	Product	Platform	Versions
SAP_SE	SAP Approuter	—	SAP Approuter node.js package < 21.2.0

Weakness (CWE)

CWE	Source	Description
CWE-601	cna	CWE-601: URL Redirection to Untrusted Site

CVSS scores (1)

Score	Severity	Version	Source	Vector
8.1	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References (2)