SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

Reported by The Hacker News ([email protected] (The Hacker News))

Summary by Cyber Security News13 Oct 2026, 19:28 CEST

About this summary. This is a short, independently written summary of an article first published by The Hacker News. Cyber Security News did not report or verify the underlying story. Read the original: https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html

A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain,

Read the full article at The Hacker News →

Source attribution: headline and facts are from The Hacker News (thehackernews.com). Summary method: excerpt of the source description. See our source attribution policy.

Related coverage

SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities

🏴☠️ Hyflock has just published a new victim : nodhom.com

SAP warns of maximum severity OAuth2 SSRF security flaw

SAP security advisory – October 2026 monthly rollup (AV26-1030)

Understanding and Mitigating Token-Pruning-Induced Vulnerabilities in VLMs

Week in review: Gyazo breach exposes 23.6M user data, TASK#STOMP steals documents