CVE-2025-27435 Overview
CVE-2025-27435 affects SAP Commerce, where an unauthenticated attacker can access customer coupon codes exposed in URL parameters of the Coupon Campaign URL. The vulnerability stems from missing authorization controls [CWE-862] on coupon campaign endpoints. An attacker who obtains the disclosed coupon codes can redeem them, resulting in impact to confidentiality and integrity of the application.
Exploitation requires specific conditions and user interaction, which limits practical attack scenarios. However, unauthenticated network access to the affected component keeps the issue relevant to public-facing SAP Commerce storefronts.
Critical Impact
Unauthenticated disclosure of customer coupon codes through URL parameters, allowing attackers to redeem promotional discounts belonging to other customers.
Affected Products
- SAP Commerce (Coupon Campaign functionality)
- Storefronts using SAP Commerce Coupon Campaign URLs
- Deployments exposing Coupon Campaign URL parameters to unauthenticated users
Discovery Timeline
- 2025-04-08 - CVE-2025-27435 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-27435
Vulnerability Analysis
The vulnerability resides in the Coupon Campaign feature of SAP Commerce. Coupon codes intended to be delivered privately to customers appear in URL parameters. These parameters can be observed by unauthenticated parties who obtain or intercept the URL through referrer headers, proxy logs, browser history, shared links, or web analytics platforms.
Because the endpoint enforces no authorization check for reading the coupon parameter, an attacker holding the URL can extract the code and use it. This maps to Missing Authorization [CWE-862], where the application fails to verify that the requester is entitled to the coupon value contained in the request.
Exploitation carries measurable but limited financial impact. Attackers gain access only to promotional codes rather than authentication credentials, personal data, or administrative functions. The attack complexity is high because the attacker must obtain a valid Coupon Campaign URL, and user interaction is required.
Root Cause
The root cause is transmission of a sensitive token (the coupon code) as a URL query parameter without authorization enforcement. URL parameters propagate through logs, caches, and referrer headers, which makes them unsuitable for carrying secrets. The application also lacks per-user binding, so any party presenting the parameter can consume the coupon.
Attack Vector
An attacker acquires a Coupon Campaign URL through shared links, referrer leakage to third-party sites, log exposure, or social engineering. The attacker extracts the coupon parameter and submits it to the SAP Commerce checkout flow to redeem the discount. No authentication to the SAP Commerce application is required to read the coupon value from the URL.
No verified public exploit code is available for this issue. Refer to SAP Note #3539465 for vendor technical details.
Detection Methods for CVE-2025-27435
Indicators of Compromise
- Repeated redemption of the same coupon code from different IP addresses or user accounts.
- Web server access logs containing Coupon Campaign URL parameters accessed by unauthenticated sessions or unusual referrers.
- Anomalous spikes in coupon redemption rates against specific campaigns.
- Coupon codes appearing in referrer headers logged by third-party services or CDN logs.
Detection Strategies
- Review SAP Commerce access logs for GET requests to Coupon Campaign URLs containing coupon parameters accessed without an authenticated customer session.
- Correlate coupon redemption events with the customer identity to which the coupon was originally issued and alert on mismatches.
- Monitor referrer header exports and third-party analytics feeds for exposed coupon parameter values.
Monitoring Recommendations
- Enable full URL logging on Coupon Campaign endpoints and retain for forensic review.
- Configure alerts for a single coupon code redeemed across multiple sessions or geographies.
- Audit outbound referrer policy on pages that surface Coupon Campaign URLs to prevent leakage.
How to Mitigate CVE-2025-27435
Immediate Actions Required
- Apply the fix described in SAP Note #3539465 to affected SAP Commerce instances.
- Invalidate coupon codes suspected of exposure and reissue them through authenticated delivery channels.
- Review web server, proxy, and analytics logs for historical exposure of Coupon Campaign URLs.
Patch Information
SAP addressed this vulnerability as part of the SAP Security Patch Day. Administrators should consult SAP Note #3539465 and the SAP Security Patch Day Announcement for version-specific patch details and deployment guidance.
Workarounds
- Restrict access to Coupon Campaign URLs by binding coupons to authenticated customer sessions where possible.
- Configure the storefront to set Referrer-Policy: no-referrer on pages that surface Coupon Campaign URLs to prevent leakage to third parties.
- Rotate exposed coupon codes and shorten coupon validity windows until patches are applied.
- Sanitize URL parameters from access logs and analytics collection to reduce downstream exposure.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
