HTTP Redirection Vulnerability in SAP Commerce Cloud by SAP

CVE-2025-26654

What is CVE-2025-26654?

SAP Commerce Cloud's inability to fully disable unencrypted HTTP on port 80 poses a significant risk as it allows HTTP traffic to be redirected to HTTPS. This design flaw can compromise the confidentiality and integrity of data transmitted during the initial client request made over HTTP, prior to the redirect. Clients that inadvertently connect via HTTP may expose sensitive information, creating a potential vulnerability for businesses relying on secure communications.

References