# SAP Cloud SDK for Python flaw sends OAuth client secrets to attackers

Source: https://startwithidentity.com/blog/2026-10-13-sap-cloud-sdk-python-flaw-sends-oauth-client-secrets-to-attackers/
Last updated: 2026-10-13
License: content by Start with Identity. Cite the source URL.

---

SAP published advisory GHSA-4mv3-jxxm-9cx2 on October 13 for CVE-2026-89111 (CVSS 10.0), a server-side request forgery in the SAP Cloud SDK for Python used by multi-tenant applications on SAP Business Technology Platform. The SDK builds the OAuth2 token URL by inserting the tenant subdomain, and before version 0.45.2 it accepted any value. An attacker who controls that subdomain can send the token request, with the application's client ID and client secret, to a server they run. The fix, released August 21 as an unlabelled bug fix, accepts only a valid DNS label. The Hacker News found the check absent again in releases 0.53.0 to 0.55.0 and across the 0.36 line; 0.55.1 and later have it. No attacks are reported. GitHub user SunandM reported the flaw.

## Why it matters

In an OAuth [client credentials](https://startwithidentity.com/glossary/client-credentials/) flow, the client secret is the application. Anyone holding it can request tokens with every scope the app was granted, without a user or an MFA prompt. Details and hunting steps are in our [CVE-2026-89111 brief](https://startwithidentity.com/cves/cve-2026-89111/).

This is SAP's developer SDK, not its customer identity product [SAP Customer Data Cloud](https://startwithidentity.com/vendors/ciam/sap-customer-data-cloud/). The broader lesson applies to any multi-tenant SaaS: never let tenant input decide where a credential is sent. Upgrade to 0.55.1 or later, validate subdomains against your registered tenant list, and rotate client secrets for any app that ran an unchecked release with tenant input an outsider could set. SAP's advisory does not ask for that rotation; we would do it anyway.

Source: [The Hacker News](https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html)