SAP Cloud SDK for Python Lets Attackers Steal OAuth2 Credentials Through a Tenant Subdomain Input — CVSS 10.0
Photo: Forkast
An attacker can hijack OAuth2 token requests in the SAP Cloud SDK for Python by manipulating the tenant_subdomain parameter, a flaw that exposes application client IDs and secrets without requiring authentication. This Server-Side Request Forgery ( CWE-918 ) vulnerability, tracked as CVE-2026-89111 , carries a CVSS score of 10.0 out of 10. The SDK handles authentication for multi-tenant SAP Business Technology Platform (BTP) applications using client credentials — a client ID and a client secret.
Source: Forkast
