{"uuid": "6c8eeada-63f6-493a-b66a-570236d45f8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89111", "type": "seen", "source": "https://infosec.exchange/users/edwardk/statuses/117436038932932309", "content": "SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft\nSAP has disclosed a critical flaw (CVE-2026-89111, CVSS 10.0) in its Cloud SDK for Python that can send an application\u2019s OAuth2 client credentials to a server an attacker controls, The Hacker News reports. The flaw affects multi-tenant applications on SAP Business Technology Platform where an attacker can control the tenant subdomain; a fix first shipped in version 0.45.2. https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html", "creation_timestamp": "2026-10-13T22:49:06.746646Z"}