CVE-2026-66773
Received Received - Intake

Authentication Bypass in SAP OData Service

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: SAP SE

Description
A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-66773
EUVD
EUVD-2026-55885

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
sap python_pyodata to 1.11.2 (exc)
sap python_pyodata 1.12.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a malicious or compromised OData service that could expose sensitive authentication details and inject untrusted data into an application. It primarily affects confidentiality with a high impact, while integrity is low and availability is unaffected.

Impact Analysis

An attacker could exploit this to steal authentication credentials or manipulate application data, leading to unauthorized access or data breaches. The impact is mainly on confidentiality, with limited effect on data integrity.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR and HIPAA requirements for protecting sensitive information. Non-compliance may result in legal penalties or data breach notifications.

Mitigation Strategies

Implement strict input validation for OData service requests to prevent injection of untrusted data. Ensure authentication credentials are not exposed in logs or error messages. Restrict access to the OData service to trusted users only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66773. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart