CVE-2026-44745: SAP Approuter Auth Bypass Vulnerability

CVE-2026-44745 Overview

CVE-2026-44745 affects SAP Approuter, which fails to properly validate incoming request headers during the OAuth2 login flow under certain configurations. An unauthenticated remote attacker can craft a malicious link that, when clicked by a victim, redirects the OAuth2 flow to an attacker-controlled destination. Successful exploitation results in unauthorized access with high impact to confidentiality and integrity of the application. The weakness is classified as URL Redirection to Untrusted Site [CWE-601], commonly known as an open redirect abused within an authentication flow.

Critical Impact
Attackers can hijack OAuth2 authentication flows and gain unauthorized access to protected SAP application resources by luring users to click a crafted link.

Affected Products

SAP Approuter (component of SAP Business Technology Platform)
Deployments using OAuth2 login flows under vulnerable configurations
Refer to SAP Note #3741519 for the exact affected versions

Discovery Timeline

2026-07-14 - CVE-2026-44745 published to the National Vulnerability Database
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-44745

Vulnerability Analysis

SAP Approuter acts as a reverse proxy and central entry point for SAP Business Technology Platform applications. It brokers authentication between end users and backend services using OAuth2 flows. The vulnerable code path fails to properly validate certain incoming request headers processed during the OAuth2 login handshake.

Because header values influence redirect destinations in the login flow, an attacker can inject values that steer the authenticated session or authorization response toward attacker-controlled infrastructure. The user interaction requirement is limited to clicking a crafted URL, which is trivial to satisfy through phishing. The confidentiality and integrity of authenticated sessions are directly at risk.

Root Cause

The root cause is improper validation of trust boundaries for request headers consumed during OAuth2 login processing [CWE-601]. Approuter treats attacker-influenced header values as authoritative for redirect logic, without enforcing an allowlist of trusted hosts or verifying that the redirect target matches the registered application origin.

Attack Vector

The attack requires network access to the Approuter endpoint and one victim interaction. An attacker crafts a link containing malicious header-influencing parameters and delivers it through phishing, chat, or a compromised web page. When the victim clicks the link and completes the OAuth2 login, the authorization response is redirected or leaked to an attacker-controlled endpoint. The attacker then replays tokens or authorization codes to impersonate the victim against protected backend services.

No verified proof-of-concept code has been published. Refer to the SAP Note #3741519 advisory for exploit prerequisites and configuration details.

Detection Methods for CVE-2026-44745

Indicators of Compromise

OAuth2 authorization requests where the effective redirect target does not match a known SAP application origin.
Approuter access logs showing unusual Host, X-Forwarded-Host, or Referer header values during /login/callback or OAuth2 endpoints.
Outbound requests from user browsers to unfamiliar domains immediately following a successful Approuter login.
Multiple failed or repeated OAuth2 login attempts originating from the same source with varying header values.

Detection Strategies

Enable verbose Approuter access logging and parse request headers involved in OAuth2 redirect construction.
Correlate authentication events with downstream destination hosts to detect off-tenant redirects.
Deploy web application firewall rules that validate Host and X-Forwarded-* headers against an allowlist for Approuter endpoints.

Monitoring Recommendations

Forward Approuter and identity provider logs to a centralized SIEM for correlation and long-term retention.
Alert on OAuth2 callbacks that reference hosts outside of the organization's registered SAP BTP domains.
Monitor for spikes in login flow errors, which may indicate probing for vulnerable header handling.

How to Mitigate CVE-2026-44745

Immediate Actions Required

Apply the patch described in SAP Note #3741519 to all Approuter instances.
Review Approuter configurations for OAuth2 routes and confirm they align with SAP's post-patch guidance.
Rotate OAuth2 client secrets and invalidate active sessions for users who may have clicked suspicious links.
Communicate phishing awareness guidance to users of SAP BTP applications served by Approuter.

Patch Information

SAP addressed CVE-2026-44745 in the July 2026 SAP Security Patch Day release. The authoritative fix and version guidance are published in SAP Note #3741519, and the broader release bulletin is available on the SAP Security Patch Day portal. Customers running self-managed Approuter deployments must upgrade the @sap/approuter package to the fixed version listed in the note.

Workarounds

Restrict Approuter reachability to trusted networks or identity-aware proxies while patching is scheduled.
Configure upstream load balancers or reverse proxies to strip or normalize untrusted X-Forwarded-Host and related headers.
Enforce strict allowlists for OAuth2 redirect URIs in the identity provider to reject unregistered destinations.

bash

# Update the SAP Approuter package to the patched version per SAP Note #3741519
npm install @sap/approuter@latest --save

# Verify the installed version matches the fixed release
npm ls @sap/approuter