Priority LOW 30
SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00358 · Published 2026-08-11 · No fix listed CWE-644
Priority LOW 27
SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations.
CVSS 3.1MEDIUM 5.9· Network · Low privileges · No interaction · EPSS 0.00439 · Published 2026-08-11 · No fix listed CWE-22
Priority LOW 26
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions.
CVSS 3.1MEDIUM 5.9· Network · Low privileges · No interaction · EPSS 0.002 · Published 2026-08-11 · No fix listed CWE-347
Priority LOW 19
SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00165 · Published 2026-08-11 · No fix listed CWE-352
Priority LOW 18
SAP Approuter does not consistently handle certain error conditions.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00353 · Published 2026-08-11 · No fix listed CWE-754
Priority LOW 20
SAP Approuter does not enforce sufficient flow control in certain functionality.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00382 · Published 2026-08-11 · No fix listed CWE-770
Priority LOW 28
SAP Approuter does not correctly validate client certificates in certain callback flows.
CVSS 3.1MEDIUM 6.4· Network · Low privileges · No interaction · EPSS 0.00181 · Published 2026-08-11 · No fix listed CWE-295
Priority LOW 18
SAP Approuter does not sufficiently validate tenant context in inbound requests.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00346 · Published 2026-08-11 · No fix listed CWE-807
Priority LOW 27
SAP Approuter does not sufficiently handle certain requests under specific conditions.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00429 · Published 2026-08-11 · No fix listed CWE-770
Priority LOW 26
WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality.
CVSS 3.1MEDIUM 5.9· Network · Low privileges · No interaction · EPSS 0.00278 · Published 2026-08-11 · No fix listed CWE-862
Priority LOW 31
SAP Approuter does not sufficiently validate certain token content under specific configurations.
CVSS 3.1HIGH 7.0· Network · No auth · No interaction · EPSS 0.00314 · Published 2026-08-11 · Fixed in 23.0.0 CWE-601
Priority LOW 38
SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00466 · Published 2026-07-14 · Fixed in 21.2.0 CWE-601
Priority MEDIUM 48
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00682 · Published 2026-07-14 · Fixed in 20.10.0 CWE-444
THREATIST.IORead the docs