Start with Identity
Subscribe
Identity CVE · OAuth / OIDC / JWT

CVE-2026-89111SAP Cloud SDK for Python sends OAuth2 client secrets to an attacker-chosen host

critical · CVSS 10.0
Product: SAP Cloud SDK for Python (sap-cloud-sdk)Vendor: SAPCWE-918Disclosed: 2026-10-13Status: PatchedProtocol deep diveNVD ↗

What broke

CVE-2026-89111 (CVSS 10.0, CWE-918) sits in how the SAP Cloud SDK for Python builds OAuth2 token URLs for multi-tenant applications on SAP Business Technology Platform. The SDK takes the token endpoint from configuration and substitutes the tenant subdomain into it. Before version 0.45.2 it used whatever value it was given, so an attacker who controls tenant_subdomain could point the token request at their own server. The SDK then sent the application's client credentials, its client ID and client secret, to that host.

The fix in 0.45.2 rejects any subdomain that is not a valid RFC 1123 DNS label. SAP published the advisory (GHSA-4mv3-jxxm-9cx2) on October 13, 2026, 53 days after the fix shipped as an unlabelled bug fix on August 21. No exploitation is reported.

Testing by The Hacker News found the check missing again in releases 0.53.0 through 0.55.0 and in the whole 0.36 line, which SAP's advisory does not list. Releases 0.45.2 to 0.52.2 and 0.55.1 or later contain it.

Why it matters

In the client credentials grant the secret is the application's identity. Whoever holds it can request tokens as the app, with every scope the app was granted, from anywhere, and no user or MFA prompt is involved. The bug is a confused-deputy: the SDK authenticated faithfully, just to the wrong authorization server, because it trusted a tenant-supplied value to build the address of a trusted endpoint.

What to do

  • Upgrade sap-cloud-sdk to 0.55.1 or later. Do not stop at 0.53.0 to 0.55.0 or stay on any 0.36 release.
  • Where you cannot upgrade yet, compare each tenant subdomain against your list of registered tenants before passing it to the SDK.
  • Never build token endpoint URLs from request data. Pin the authorization server per tenant in configuration.

After you patch

  • Rotate the client secrets of any application that ran an unchecked release with attacker-reachable tenant input. SAP's advisory does not say this, but a secret sent to an unknown host should be treated as disclosed.
  • Review token issuance logs on your BTP authorization service for client credential grants from unfamiliar addresses.

Sources

Related on Start with Identity

Last reviewed By SWI Community TeamSuggest a correctionHow we research
Know a primary source we should add, or a patch status that has changed? Email community@startwithidentity.com. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.