SAP Cloud SDK for Python Lets Attackers Steal OAuth2 Credentials Through a Tenant Subdomain Input — CVSS 10.0
SAP Cloud SDK for Python has a critical vulnerability (CVE-2026-89111, CVSS 10.0) allowing attackers to steal OAuth2 credentials via tenant subdomain manipulation. The flaw affects multi-tenant SAP BTP applications. A fix was released in August 2026, but later versions reintroduced the issue. The vulnerability existed since the SDK's initial release in March 2026.




