SAP Cloud SDK for Python flaw sends OAuth client secrets to attackers
CVE-2026-89111, rated CVSS 10.0, lets whoever controls the tenant subdomain in a multi-tenant SAP BTP app redirect its OAuth2 token request and capture the client ID and secret. Fixed in 0.45.2, but the check went missing again in later releases.
SAP published advisory GHSA-4mv3-jxxm-9cx2 on October 13 for CVE-2026-89111 (CVSS 10.0), a server-side request forgery in the SAP Cloud SDK for Python used by multi-tenant applications on SAP Business Technology Platform. The SDK builds the OAuth2 token URL by inserting the tenant subdomain, and before version 0.45.2 it accepted any value. An attacker who controls that subdomain can send the token request, with the application's client ID and client secret, to a server they run. The fix, released August 21 as an unlabelled bug fix, accepts only a valid DNS label. The Hacker News found the check absent again in releases 0.53.0 to 0.55.0 and across the 0.36 line; 0.55.1 and later have it. No attacks are reported. GitHub user SunandM reported the flaw.
Why it matters
In an OAuth client credentials flow, the client secret is the application. Anyone holding it can request tokens with every scope the app was granted, without a user or an MFA prompt. Details and hunting steps are in our CVE-2026-89111 brief.
This is SAP's developer SDK, not its customer identity product SAP Customer Data Cloud. The broader lesson applies to any multi-tenant SaaS: never let tenant input decide where a credential is sent. Upgrade to 0.55.1 or later, validate subdomains against your registered tenant list, and rotate client secrets for any app that ran an unchecked release with tenant input an outsider could set. SAP's advisory does not ask for that rotation; we would do it anyway.
Source: The Hacker News
Related on Start with Identity
- BlogLXD and MicroCloud flaw let attackers pose as any trusted client using only its public certificate
Canonical's CVE-2026-112816 let an attacker authenticate to the LXD and MicroCloud HTTPS API as any trusted client by attaching that client's public certificate
- BlogDocker Sandboxes copy flaw let an AI agent reach host files such as cloud keys and SSH keys
A symlink flaw in the Docker Sandboxes copy command, CVE-2026-103916, let an AI coding agent inside the sandbox read or write host files outside its allowlist,
- BlogAuthMask flaw let any Android app pull work-account tokens from Microsoft Authenticator
Enclave disclosed on October 23 that Microsoft Authenticator for Android trusted a caller's claimed identity, so a zero-permission app could pose as Teams and r
- GlossaryOAuth Client ID Metadata Document (CIMD)
An OAuth Client ID Metadata Document (CIMD) is a JSON document of client metadata hosted at an HTTPS URL that the client uses as its `client_id`, so an authoriz
- CVEDrupal Simple OAuth/OIDC auth bypass via an alternate path
Drupal Simple OAuth / OIDC 6.0.0 through 6.0.6 allowed authentication to be skipped on an alternate path. Patched in 6.0.7.
- CVEDuende OAuth token management mixes tokens across requests
A race in Duende's .NET OAuth token-management package could attach client A's token to client B's request. Session mix-up, not a crypto break, but it is still