SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

SAP has disclosed a critical flaw (CVE-2026-89111, CVSS 10.0) in its Cloud SDK for Python that can send an application’s OAuth2 client credentials to a server an attacker controls, The Hacker News reports. The flaw affects multi-tenant applications on SAP Business Technology Platform where an attacker can control the tenant subdomain; a fix first shipped in version 0.45.2.