CVE-2026-66760

Name of the Vulnerable Software and Affected Versions SAP Approuter (affected versions not specified)

Description SAP Approuter fails to correctly validate client certificates during specific callback flows. An attacker with low privileges who possesses a certificate issued by the same trusted authority with matching subject values can bypass the identity check. This flaw allows for the impersonation of a trusted internal component, which significantly impacts integrity while having a lower impact on confidentiality and availability.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.