CVE-2026-44745: SAP Approuter open redirect in OAuth2 login flow

Executive brief

SAP Approuter is a critical gateway component used by enterprises to manage authentication and routing for cloud applications. This vulnerability allows attackers to craft deceptive links that, when clicked by users during login, redirect them to malicious websites designed to steal credentials. An attacker without authentication can exploit this to compromise user accounts and gain unauthorized access to sensitive business applications.

Technical details

The vulnerability is a CWE-601 (URL Redirection to Untrusted Site) open redirect flaw in the OAuth2 login flow. SAP Approuter fails to properly validate incoming request headers under certain configurations, allowing an unauthenticated attacker to inject a malicious redirect URL. The attack requires user interaction (clicking a crafted link) but no authentication or elevated privileges. A victim clicking the malicious link will be redirected to an attacker-controlled site, potentially resulting in credential theft or session hijacking. The vulnerability affects all versions prior to 21.2.0, which includes the fix. The attack vector is network-based with low complexity.

Affected products

• SAP Approuter < 21.2.0

Timeline

• 2026-07-14: disclosed
• 2026-07-14: patched: Version 21.2.0 released with patch

References

• https://api.github.com/users/henrybrink
• https://github.com/henrybrink
• https://api.github.com/users/henrybrink/gists%7B/gist_id%7D
• https://api.github.com/users/henrybrink/repos
• https://avatars.githubusercontent.com/u/20884220?v=4
• https://api.github.com/users/henrybrink/events%7B/privacy%7D