A flaw in SAP's Cloud SDK for Python can send an application's OAuth2 client credentials to a server an attacker controls, SAP said in a security advisory on October 13. The flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, SAP's official Python client for BTP services. An attacker must be able to control the tenant subdomain,



Source: TheHackerNews
Source Link: https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html