{"id":"GHSA-44p5-3m5g-vfhj","revision":"1625be9be95740f496d31616cf36b689","records":[{"revision":"1625be9be95740f496d31616cf36b689","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-44p5-3m5g-vfhj","aliases":["CVE-2026-44745"],"title":"SAP Approuter has an Open Redirect vulnerability","description":"SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application.","state":0,"publishedAt":"2026-07-14T03:31:35+00:00","modifiedAt":"2026-09-01T21:40:52.202902+00:00","affected":[{"ecosystem":"npm","name":"@sap/approuter","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"21.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2026-44745","https://me.sap.com/notes/3741519","https://url.sap/sapsecuritypatchday"],"sourceUrl":"https://github.com/advisories/GHSA-44p5-3m5g-vfhj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-44p5-3m5g-vfhj","identifiers":["GHSA-44p5-3m5g-vfhj","CVE-2026-44745"]},"retained":false,"historicalAffected":[]}],"coverage":[]}