Vulnerability · Published Jul 14, 2026 · Assigned by sap

CVE-2026-44745Open Redirect vulnerability in SAP Approuter

High 8.1

In plain English

A high-severity open redirect in SAP Approuter from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	@sap/approuter	21.2.0	GHSA-44p5-3m5g-vfhj

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP Approuter	SAP Approuter node.js package < 21.2.0

Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References