SAP Cloud SDK for Python Lets Attackers Steal OAuth2 Credentials Through a Tenant Subdomain Input — CVSS 10.0

An attacker can hijack OAuth2 token requests in the SAP Cloud SDK for Python by manipulating the tenant_subdomain parameter, a flaw that exposes application client IDs and secrets without requiring authentication. This Server-Side Request Forgery ( CWE-918 ) vulnerability, tracked as CVE-2026-89111 , carries a CVSS score of 10.0 out of 10. The SDK handles authentication for multi-tenant SAP Business Technology Platform (BTP) applications using client credentials — a client ID and a client secret. When an application passes a tenant subdomain, the SDK takes the token URL from the application’s configuration, replaces part of it with the subdomain value, and sends the credentials to the resulting URL to request an access token. Releases without a validation check used whatever value they were given.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Forkast.