SAP Cloud SDK for Python OAuth2 SSRF (CVE-2026-89111, CVSS 10.0) Leads October Patch Day
A tenant_subdomain value can redirect OAuth2 token requests and leak client credentials in SAP's Python SDK. Three more critical SAP flaws shipped; no exploitation reported.
· 7 min