Description

SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send a specially crafted request that bypasses the integrity check and loads another user's session context. Successful exploitation requires the attacker to have previously observed matching session values out-of-band, which makes the attack complex to execute. This could result in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-11T01:17:24.030Z",
  "pubdate": "2026-08-11T01:17:24.030Z",
  "executiveSummary": "A session integrity verification vulnerability exists in SAP Approuter, affecting session-related request headers under specific conditions. The vulnerability allows an authenticated attacker with low privileges to bypass cryptographic or structural integrity checks implemented by the routing component.\nBy submitting a specially crafted HTTP request containing previously observed session values acquired through out-of-band methods, an attacker can coerce the application into loading another user's active session context.\nSuccessful exploitation of this flaw leads to a high impact on data confidentiality through unauthorized cross-session data access, alongside a low impact on data integrity. There is no associated impact on system availability.\nAlthough the architectural impact on confidentiality is high, the overall risk is modulated by the requirement for prior out-of-band observation of valid session identifiers, which increases the execution complexity of the attack vector.",
  "technicalDetails": "The vulnerability resides within the session management and request routing logic of SAP Approuter, specifically in the mechanisms responsible for validating the integrity of session-related request headers.\nThe root cause stems from inconsistent enforcement of integrity checks on specific inbound HTTP headers that dictate session context resolution under certain operational states.\nThe vulnerable component fails to properly cryptographically bind or validate the origin and authenticity of the session header against the corresponding transport layer security context or established cookie stores, allowing header manipulation to succeed.\nTo execute the attack, an adversary with low-privilege access must first acquire valid session-related header values belonging to another user via out-of-band vectors such as network sniffing, logging exposure, or cross-site information disclosure.\nThe attacker then crafts an HTTP request incorporating these intercepted session headers and transmits it to the exposed SAP Approuter endpoint.\nUpon receiving the request, the Approuter processes the headers without enforcing the requisite integrity verification checks. Consequently, the routing engine improperly associates the incoming request stream with the foreign session context.\nThis behavior results in the execution of downstream application logic within the security context of the victim user, exposing sensitive application data and resources accessible to that session.\nThe exploitation vector requires network exposure to the SAP Approuter service, low-privilege authentication capabilities, and pre-acquired target session data."
}