Description
SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment.
Recommendation
Update the @sap/approuter package to the latest compatible version. Followings are version details:
- Affected version(s): < 23.0.0
- Patched version(s): 23.0.0
References
Could your website be exposed too?
SmartScanner can check your website for SAP Approuter has an Information Disclosure vulnerability and gives you actionable findings to investigate.
Start a free scanRelated Issues
- SAP Approuter has an Open Redirect vulnerability - CVE-2026-44745
- SAP Approuter Vulnerable to HTTP Request Smuggling - CVE-2026-27690
- automagik-genie has a command injection vulnerability - CVE-2026-30635
- ProseMirror has a XSS vulnerability in prosemirror-view's paste handling - CVE-2026-104847
You might also like:
See something that needs correcting? Let us knowUpdated September 01, 2026