SAP addresses maximum-severity flaw in its Cloud SDK for Python

First reported by BleepingComputer at · Updated · 2 sources

The vulnerability can send an application's OAuth2 client credentials to an attacker-controlled server, according to The Hacker News, citing SAP's advisory. It affects multi-tenant applications on SAP Business Technology Platform that use the SDK, and exploitation requires control of the tenant subdomain, the outlet reports. BleepingComputer reports SAP addressed 20 flaws in its October 2026 updates.

  • The flaw carries a CVSS score of 10, according to The Hacker News.

Covered by 2 publishers within 4 hours of the first report.

Reporting2

BleepingComputer SAP warns of maximum severity OAuth2 SSRF security flaw · Sergiu Gatlan
The Hacker News SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft · info@thehackernews.com (The Hacker News)