CVE-2026-44745

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results...

CVE-2026-27690

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to ...

CVE-2026-44745

Technical details are not publicly available in the provided documents. Monitor for updates on CVE-2026-44745 for potential details on affected versions, remediation, and impact.

CVE-2026-44745 Open Redirect vulnerability in SAP Approuter

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results...

EUVD-2026-43585

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results...

CVE-2026-44745

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results...

CVE-2026-27690

CVE-2026-27690 describes an HTTP Request Smuggling vulnerability in SAP Approuter. An unauthenticated attacker can send specially crafted requests to trigger request–response desynchronization, potentially exposing user responses and causing service unavailability. The CVE’s impact is listed as h...

EUVD-2026-43584

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to ...

CVE-2026-27690

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system to become unavailable. This leads to ...

PT-2026-57935

Name of the Vulnerable Software and Affected Versions SAP Approuter affected versions not specified Description An unauthenticated attacker can exploit an HTTP Request Smuggling issue by sending a specially crafted HTTP request. This leads to request-response desynchronization, a condition where...

EUVD-2025-3971

Malicious code in bioql PyPI...

Malicious code in nextjs14-approuter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 73539e0dd962fbad2bd7a634bd17a7406d5df3f1c282a29c376d97121625b95f The OpenSSF Package Analysis project identified 'nextjs14-approuter' @ 9.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2025-41274 Malicious code in nextjs14-approuter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 73539e0dd962fbad2bd7a634bd17a7406d5df3f1c282a29c376d97121625b95f The OpenSSF Package Analysis project identified 'nextjs14-approuter' @ 9.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in approuter (npm)

The package approuter was found to contain malicious code...

MAL-2025-14736 Malicious code in approuter (npm)

The package approuter was found to contain malicious code...

Vulnerabilities fixed in SAP software

SAP has fixed several vulnerabilities in its software components, including SAP Commerce, SAP NetWeaver, and SAP BusinessObjects. The vulnerabilities include Cross-Site Scripting XSS and missing authorization controls, which allow attackers to gain unauthorized access, manipulate data, and reveal...

SAP Approuter Authentication Bypass Vulnerability

SAP Approuter is a key SAP component that is primarily used to handle entry requests for all applications. An authentication bypass vulnerability exists in SAP Approuter, which can be exploited by a remote attacker to submit a special request that can bypass authentication, inject code and execut...

CVE-2025-24876

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application...

GHSA-CPFX-964W-4JVP Authentication bypass in @sap/approuter

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code, an attacker can steal the session of the victim by injecting malicious payload, causing High impact on confidentiality and integrity of the application...

Authentication bypass in @sap/approuter

The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code, an attacker can steal the session of the victim by injecting malicious payload, causing High impact on confidentiality and integrity of the application...