SAP Cloud SDK for Python flaw sends OAuth client secrets to attackers
CVE-2026-89111, rated CVSS 10.0, lets whoever controls the tenant subdomain in a multi-tenant SAP BTP app redirect its OAuth2 token request and capture the client ID and secret. Fixed in 0.45.2, but the check went missing again in later releases.
SAP published advisory GHSA-4mv3-jxxm-9cx2 on October 13 for CVE-2026-89111 (CVSS 10.0), a server-side request forgery in the SAP Cloud SDK for Python used by multi-tenant applications on SAP Business Technology Platform. The SDK builds the OAuth2 token URL by inserting the tenant subdomain, and before version 0.45.2 it accepted any value. An attacker who controls that subdomain can send the token request, with the application's client ID and client secret, to a server they run. The fix, released August 21 as an unlabelled bug fix, accepts only a valid DNS label. The Hacker News found the check absent again in releases 0.53.0 to 0.55.0 and across the 0.36 line; 0.55.1 and later have it. No attacks are reported. GitHub user SunandM reported the flaw.
Why it matters
In an OAuth client credentials flow, the client secret is the application. Anyone holding it can request tokens with every scope the app was granted, without a user or an MFA prompt. Details and hunting steps are in our CVE-2026-89111 brief.
This is SAP's developer SDK, not its customer identity product SAP Customer Data Cloud. The broader lesson applies to any multi-tenant SaaS: never let tenant input decide where a credential is sent. Upgrade to 0.55.1 or later, validate subdomains against your registered tenant list, and rotate client secrets for any app that ran an unchecked release with tenant input an outsider could set. SAP's advisory does not ask for that rotation; we would do it anyway.
Source: The Hacker News
Related on Start with Identity
- BlogOAuth client ID spoofing lets attackers validate stolen Entra credentials
Proofpoint found two campaigns submitting forged OAuth client IDs to Entra's token endpoint. Because error responses differ by whether the client ID is valid, a
- BlogBeyondTrust Remote Support zero-day let ARMORY CASTLE dump the credential vault
CVE-2026-102764, a CVSS 9.3 flaw in self-hosted BeyondTrust Remote Support through 26.2.3, was exploited as a zero-day by the China-nexus group ARMORY CASTLE. M
- BlogCisco ISE authentication bypass, CVSS 10, was exploited before the patch
CVE-2026-76460 lets an unauthenticated attacker bypass Cisco Identity Services Engine's management interface through an API endpoint and run commands as root. C
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still
- CVEOAuth 2.0 private_key_jwt audience ambiguity
A specification-level flaw in the OAuth 2.0 JWT profile: private_key_jwt audience is ambiguous, so a token minted for one authorization server can be accepted b