CVE-2026-66760

This CVE exposes a certificate validation bypass in SAP Approuter's callback flow handling. The vulnerability is not a deliberate complexity tradeoff — it's architectural debt made exploitable. The validation logic exists in the component but was applied to some code paths (standard request routing) while callback flows — which handle OAuth/OIDC redirects, token exchanges, and session continuation — were left with inconsistent or missing certificate binding checks. The result is partial validation that passes structural certificate checks (valid CA chain) while failing to verify that the certificate subject actually corresponds to the identity claimed in the callback context. The impact profile tells you who this targets: attackers who already have infrastructure-level positioning (a certificate from the same internal CA that issues certificates to trusted internal components). This is not a remote exploitation scenario — the prerequisite is genuine. The payoff is impersonation of a trusted internal routing actor, which creates high integrity risk (manipulated process flows, falsified business decisions) but limited direct confidentiality impact. The real danger is downstream: once an attacker holds a trusted-component identity, they can probe for authorization decisions that assume the certificate validation already happened. Prioritize these actions: First, identify which callback flows in your Approuter deployment handle OAuth redirects, token exchanges, or session resumption, and verify certificate subject validation is applied consistently across all of them — not just the main request path. Second, audit what business logic executes after these callback flows complete; any authorization decision that trusts the incoming identity without re-verification is a compounding risk. Third, review your internal CA issuance policy — determine which workloads receive certificates from this authority and whether tenant environments, CI/CD pipelines, or adjacent microservices have access that could satisfy the prerequisite. Fourth, apply the SAP patch promptly but document the callback flow behavior before and after — regression testing should confirm OAuth and OIDC handshakes continue functioning while the validation gap is closed. This vulnerability belongs to a recurring class where routing components receive security logic incrementally rather than architecturally. When certificate handling is backfilled flow-by-flow into components that originally served only infrastructure forwarding, callback paths are the predictable gap. Expect similar patterns in other routing layers and API gateways.

Reviewed through automated stages and approved by a human before publication.