CVE-2026-66775: SAP Approuter CSRF Vulnerability

CVE-2026-66775 Overview

CVE-2026-66775 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in SAP Approuter. The authentication flow does not enforce CSRF protection by default. An unauthenticated attacker can craft a malicious link and trick a victim into following it. Successful exploitation binds the victim's session to an attacker-controlled identity, producing a low impact on integrity. There is no impact on confidentiality or availability. The flaw requires user interaction and is exploitable over the network without prior authentication.

Critical Impact
An attacker can force a victim's authenticated session to be bound to an attacker-controlled identity, enabling session fixation-style manipulation of subsequent user actions through the SAP Approuter authentication flow.

Affected Products

SAP Approuter (authentication flow with default configuration)

Discovery Timeline

2026-08-11 - CVE-2026-66775 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-66775

Vulnerability Analysis

SAP Approuter serves as the entry point for applications running on the SAP Business Technology Platform. It handles routing and delegates authentication to an identity provider. This vulnerability exists because the authentication flow does not enforce Cross-Site Request Forgery protection by default. An attacker who lures an authenticated victim into clicking a crafted link can cause the victim's browser to complete an authentication callback tied to the attacker's identity. Any actions the victim then performs are attributed to the attacker's account, enabling data manipulation or session fixation-style abuse limited to integrity impact.

Root Cause

The root cause is missing anti-CSRF state validation on the OAuth/OIDC authentication callback handled by Approuter. Without a bound state parameter or equivalent request origin verification, the router accepts authentication responses that were not initiated by the current user session, mapping the returned identity onto the victim's session.

Attack Vector

Exploitation requires network access and user interaction. The attacker initiates an authentication flow with the victim's Approuter instance, captures the resulting login link or callback URL, and delivers it to the victim through phishing, a malicious website, or a chat message. When the victim follows the link, the browser completes the flow and the victim's active session is bound to the attacker's identity.

// No verified proof-of-concept code is available.
// See SAP Note #3786038 for vendor technical details.

Detection Methods for CVE-2026-66775

Indicators of Compromise

Authentication callback requests to Approuter that lack a valid, session-bound state parameter or arrive without a matching prior authorization request.
Sessions where the authenticated user identifier changes mid-session without an explicit logout and re-login event.
Referrer headers on authentication callbacks pointing to untrusted external domains.

Detection Strategies

Inspect Approuter access logs for authentication callback URLs delivered from external referrers or embedded in phishing infrastructure.
Correlate identity provider login events with Approuter session identifiers to flag identity mismatches within a single browser session.
Alert on repeated authentication callback hits to the same session cookie from disparate source IP addresses.

Monitoring Recommendations

Forward Approuter and identity provider logs to a centralized analytics platform and normalize authentication events for cross-correlation.
Track user-agent and geolocation drift across the authentication flow to surface anomalous session binding.
Monitor for outbound traffic to newly registered domains hosting Approuter-shaped callback URLs.

How to Mitigate CVE-2026-66775

Immediate Actions Required

Apply the fix described in SAP Note #3786038 to affected Approuter deployments.
Review the SAP Security Patch Day advisory for the corresponding release cycle and inventory all Approuter instances in scope.
Rotate active sessions and force re-authentication after patching to invalidate any sessions that may already be bound to attacker identities.

Patch Information

SAP has published remediation guidance in SAP Note #3786038, released as part of SAP Security Patch Day. Administrators should upgrade Approuter to the fixed release and enable CSRF protection on the authentication flow according to vendor documentation.

Workarounds

Configure Approuter to enforce a session-bound state parameter on all authentication callbacks where the vendor exposes this option.
Restrict allowed redirect URIs at the identity provider to trusted Approuter hostnames only.
Educate users about phishing links that initiate authentication to SAP applications and deploy email link protection where available.

bash

# Refer to SAP Note #3786038 for authoritative configuration steps.
# Vendor-neutral hardening example: ensure the identity provider enforces
# an unguessable, session-bound state parameter on the OAuth/OIDC callback.