Advisory
A note with CVSS 8.1 for component BC-CP-APR was released by SAP on 14.07.2026. The correction/advisory 3741519 was described with "3741519 - [CVE-2026-44745] Open Redirect vulnerability in SAP Approuter" and affects the system type SAP Approuter.
A workaround exists, according to SAP Security Advisory team. It is advisable to implement the correction as project.
The vulnerability addressed is open redirect within SAP Approuter.
Risk specification
SAP Approuter allows an unauthenticated remote attacker to craft a malicious link that, when accessed by a victim, redirects the user to an attacker-controlled host, potentially resulting in unauthorized access to the targeted account.
Solution
The fix introduces validation of the XSUAA redirect-uris configuration during the login callback when the X-Forwarded-Host header is present. Requests are rejected if the redirect-uris configuration is empty or contains overly broad wildcard patterns that could match applications beyond the SAP Approuter itself. Although an alternative solution exists, it is advisable to apply the correction! This is the workaround, which was suggested by the SAP security experts: "Restricting the redirect-uris in the XSUAA service instance (xs-security.json) to specific application hostnames, replacing any broad landscape-wide wildcard patterns with application-scoped patterns.".
