CVE-2026-89111
CRITICAL
NVD
CVSS Score
10
Severity
CRITICAL
Published
Oct 13, 2026
Vendor
unknown
Description
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated.