Authentication bypass via authorization code injection in SAP Approuter (SAP_SE SAP Approuter Node.js package)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.50 % · percentile 43 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Deferred
Description
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and integrity of the application
Weaknesses (CWE)
- CWE-1287 — Improper Validation of Specified Type of Input
- CWE-302 — Authentication Bypass by Assumed-Immutable Data
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | sap |
| CVSS 3.1 | HIGH 8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N | NVD · cna@sap.com (Secondary) |
Advisories
- GHSA-cpfx-964w-4jvp — Authentication bypass in @sap/approuter
European references
- ENISA EUVD · EUVD-2025-3971
- GCVE · GCVE-0-2025-24876
CERT-FR advisories
- CERTFR-2025-AVI-0190 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
- CERTFR-2025-AVI-0114 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP Approuter Node.js package | affected 2.6.1 to 16.7.1 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |