AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SAPCVE-2026-44745

SAP Approuter: open redirect

SAP

CVE-2026-44745 · Published Jul 14, 2026 · updated Sep 8, 2026

High8.1
No fix yet
SAP advisory

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application.

Affected versions

PackageAffectedFixed in
SAP Approuter
Product
<= SAP Approuter node.js package < 21.2.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-601

More SAP advisories

All SAP
Critical 9.1Jul 14SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented...CVE-2026-44761no fix yetMedium 6.1Jul 14SAP @ui5/webcomponents-base: clickjackingCVE-2026-44767no fix yetMedium 4.1Jul 14SAP WebClient UI: attacker could injectCVE-2026-44768no fix yetMedium 5.5Jul 14SAP S/4HANA Project Management (PPM-PRO): SQL injectionCVE-2026-44769no fix yetMedium 4.3Jul 14SAP S/4 HANA (Create Single Payment): missing authorizationCVE-2026-44770no fix yetMedium 4.3Jul 14SAP S/4HANA (Draft operation): privilege escalationCVE-2026-44771no fix yet