Is CVE-2026-44745 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44745 being exploited in the wild.

How severe is CVE-2026-44745?

High severity, with a CVSS score of 8.1, published 14 July 2026.

Which products and versions are affected?

@sap/approuter (npm) < 21.2.0, SEMVER:introduced=0,fixed=21.2.0; SAP SE Approuter < 21.2.0.

Is there a fix for CVE-2026-44745?

Yes. @sap/approuter (npm): upgrade to 21.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44745 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-44745?

Check whether you run @sap/approuter (npm) or SAP SE Approuter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44745: SAP Approuter open redirect in OAuth2 login flow

Q: Is there a fix for CVE-2026-44745?

Yes. @sap/approuter (npm): upgrade to 21.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44745 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-44745?

Check whether you run @sap/approuter (npm) or SAP SE Approuter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44745 · Severity: high · CVSS 8.1 · Published 2026-07-14

SAP Approuter is a critical gateway component used by enterprises to manage authentication and routing for cloud applications. This vulnerability allows attackers to craft deceptive links that, when clicked by users during login, redirect them to malicious websites designed to steal credentials. An attacker without authentication can exploit this to compromise user accounts and gain unauthorized access to sensitive business applications.

Technologies: @sap/approuter (npm). Vendors: npm, SAP SE.

Quick answers

Is CVE-2026-44745 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44745 being exploited in the wild.
How severe is CVE-2026-44745?: High severity, with a CVSS score of 8.1, published 14 July 2026.
Which products and versions are affected?: @sap/approuter (npm) < 21.2.0, SEMVER:introduced=0,fixed=21.2.0; SAP SE Approuter < 21.2.0.
Is there a fix for CVE-2026-44745?: Yes. @sap/approuter (npm): upgrade to 21.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44745 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-44745?: Check whether you run @sap/approuter (npm) or SAP SE Approuter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@sap/approuter (npm): upgrade to 21.2.0 or later
```
npm install @sap/approuter@21.2.0
```

Technical details

The vulnerability is a CWE-601 (URL Redirection to Untrusted Site) open redirect flaw in the OAuth2 login flow. SAP Approuter fails to properly validate incoming request headers under certain configurations, allowing an unauthenticated attacker to inject a malicious redirect URL. The attack requires user interaction (clicking a crafted link) but no authentication or elevated privileges. A victim clicking the malicious link will be redirected to an attacker-controlled site, potentially resulting in credential theft or session hijacking. The vulnerability affects all versions prior to 21.2.0, which includes the fix. The attack vector is network-based with low complexity.

Affected products

SAP Approuter < 21.2.0

Identifiers

CVE-2026-44745
GHSA-44p5-3m5g-vfhj

Timeline

2026-07-14: disclosed
2026-07-14: patched: Version 21.2.0 released with patch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.