#8
The Hacker News
general
October 13, 2026 at 17:28 UTC
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
By [email protected] (The Hacker News)
AI Summary
SAP disclosed a CVSS 10.0 flaw in its Cloud SDK for Python affecting multi-tenant applications on SAP Business Technology Platform (BTP), which can cause an app to send its OAuth2 client credentials to an attacker-controlled server. The advisory, published October 13, requires an attacker to control only the tenant subdomain to trigger credential exfiltration. Organizations running BTP services with the Python SDK in multi-tenant configurations should treat this as an urgent remediation priority.
Relevance score: 83.0/100
Sponsored
Protect Your Business
Expert cybersecurity solutions to safeguard your organization from evolving threats.
Get Protected →