News · Oct 13, 2026
SAP Cloud SDK for Python flaw sends OAuth client secrets to attackers
CVE-2026-89111, rated CVSS 10.0, lets whoever controls the tenant subdomain in a multi-tenant SAP BTP app redirect its OAuth2 token request and capture the client ID and secret. Fixed in 0.45.2, but the check went missing again in later releases.