CVE-2026-66776 describes an improper verification of cryptographic signatures (CWE-347) in SAP Business AI Platform's Approuter component. Specifically, the product fails to consistently enforce integrity checks on some session-related request headers under certain conditions. This flaw allows an attacker with low privileges, who has previously observed session values externally, to bypass integrity checks and impersonate another user's session context. The vulnerability has a CVSS 3.1 base score of 5.9, reflecting medium severity, with a high impact on confidentiality and low impact on integrity, and no availability impact.

Successful exploitation could lead to unauthorized access to another user's session context, compromising confidentiality significantly. Integrity is affected to a lesser degree, while availability remains unaffected. The attack complexity is high due to the need for prior observation of session values outside the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Organizations should monitor SAP advisories for updates and apply any future patches promptly.