CVE-2026-66773 Server-controlled `__next` URL is not checking cross-origin
A malicious OData service can exploit an unchecked server-controlled URL to disclose sensitive authentication information and inject untrusted data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-66773?
CVE-2026-66773 is a medium-severity vulnerability in SAP_SE Odata, published on 11 Aug 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on confidentiality and low impact on integrity and no impact on Availability.
Weakness: CWE-601
Which versions are affected by CVE-2026-66773?
How do I fix CVE-2026-66773?
No fix has been published for CVE-2026-66773 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-66773 being exploited?
There is no known exploitation of CVE-2026-66773 in the wild and no public exploit code.
Sources
Also known as GHSA-hc5j-q32w-c25v, GHSA-wj2g-hp6v-8wj4.