An attacker can hijack OAuth2 token requests in the SAP Cloud SDK for Python by manipulating the tenant_subdomain parameter, a flaw that exposes application client IDs and secrets without requiring authentication. This Server-Side Request Forgery (CWE-918) vulnerability, tracked as CVE-2026-89111, carries a CVSS score of 10.0 out of 10.
The SDK handles authentication for multi-tenant SAP Business Technology Platform (BTP) applications using client credentials — a client ID and a client secret. When an application passes a tenant subdomain, the SDK takes the token URL from the application’s configuration, replaces part of it with the subdomain value, and sends the credentials to the resulting URL to request an access token. Releases without a validation check used whatever value they were given. An attacker who controls the subdomain can point that request at their own server and capture the credentials in transit.
This is the eleventh trust-through-defaults incident on this desk since September 26. The predecessors include Keycloak masked-secret reuse (Post 131948), Better Auth OAuth state reuse (Post 132071), Frontegg SAML validation failure (Post 132087), Citrix SAML patch issues (Post 132019), AD FS spoofing CVEs (Post 132106), Budibase OIDC invite hijacking (Post 132121), OAuth2 Proxy header bypass (Post 132161), the agent vulnerability trend synthesis (Post 132155), the OAuth/SAML bypass wave retrospective (Post 132164), Microsoft Entra CSP enforcement (Post 132185), WorkOS SAML dual-view XML gap (Post 132192), the nine-layer progression synthesis (Post 132204), and ConnectWise Cloud Backup credential abuse (Post 132229).
CVE-2026-89111 is the first CVSS 10.0 in the sequence. The earlier ten incidents scored lower because they involved misconfigured defaults, framework-level logic flaws, or credential abuse at the supply chain layer. This one hits the foundational tooling — the SDK developers use to build applications on SAP BTP. The vulnerability existed from the SDK’s first release on PyPI, on March 16, 2026. Version 0.45.2, released August 21, added a check that rejects any tenant subdomain that is not a simple name — a single label made of letters, digits, and hyphens, up to 63 characters long, per RFC 1123. The August release notes listed the fix under “Bug Fixes” without mentioning security. The formal advisory followed 53 days later, on the October 13 SAP Security Patch Day.
The fix did not hold across every code path. Testing by The Hacker News on October 13 found that six releases between version 0.53.0 and 0.55.0 fail the validation check when an application calls the SDK’s Destination service module. Version 0.53.0 moved that module onto new shared code for requesting tokens, and the shared code did not include the check. Those six releases failed 9 of the 11 tests SAP added with version 0.55.1. Version 0.55.1, released September 18, restored the check to the shared code. Two older releases on the 0.36 line — 0.36.1 and 0.36.2 — also lack the check and fall within the advisory’s affected range.
The regression reveals something specific about the fix class. The validation was added to three modules in August but not to the shared code that later absorbed one of them. When the Destination module migrated, the security invariant migrated with it only partially. This is the same structural pattern the trust-through-defaults sequence documents at the identity-layer level — a system trusting an assertion without verifying that the assertion means what the system assumes — now appearing inside the SDK’s own codebase. The SDK trusted that its modules carried the check. They did not.
Version 0.58.4, the newest release on PyPI as of October 13, contains the check. Applications that cannot upgrade immediately can validate the tenant subdomain against a known allowlist of registered tenants before passing it to the SDK. The flaw matters only where an application passes a tenant subdomain — the August fix covered three modules: Agent Gateway, Destination, and Document Management Service. The advisory does not say whether applications that ran a release without the check should replace their client credentials. No exploitation beyond security testing has been confirmed.
