SAP has disclosed a critical vulnerability in its Cloud SDK for Python that allows an attacker to send an application's OAuth2 client credentials to a server they control.
This flaw affects multi-tenant applications on SAP Business Technology Platform (BTP) that use the SDK, which is SAP's official Python client for BTP services.
The vulnerability requires an attacker to have control over the tenant subdomain. SAP issued a security advisory on October 13 detailing the issue.
Sources and references
Original report
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
The Hacker News
Read on The Hacker News (opens in a new tab)Ref 00HZE10M
Cite this
APA
Interestana AI Editorial. (2026, October 13). SAP Cloud SDK for Python Suffers Critical OAuth2 Credential Theft Flaw. Interestana. https://interestana.com/articles/sap-discloses-critical-cvss-10-flaw-in-cloud-sdk-for-python-allowing-oauth2-credential-theft-00hze10m
MLA
“SAP Cloud SDK for Python Suffers Critical OAuth2 Credential Theft Flaw.” Interestana, 13 Oct. 2026, interestana.com/articles/sap-discloses-critical-cvss-10-flaw-in-cloud-sdk-for-python-allowing-oauth2-credential-theft-00hze10m.
Chicago
Interestana AI Editorial. “SAP Cloud SDK for Python Suffers Critical OAuth2 Credential Theft Flaw.” Interestana, October 13, 2026. https://interestana.com/articles/sap-discloses-critical-cvss-10-flaw-in-cloud-sdk-for-python-allowing-oauth2-credential-theft-00hze10m.
BibTeX
@misc{interestana_00hze10m,
author = {{Interestana AI Editorial}},
title = {{SAP Cloud SDK for Python Suffers Critical OAuth2 Credential Theft Flaw}},
howpublished = {Interestana},
year = {2026},
month = oct,
url = {https://interestana.com/articles/sap-discloses-critical-cvss-10-flaw-in-cloud-sdk-for-python-allowing-oauth2-credential-theft-00hze10m},
note = {Summary of reporting by The Hacker News, https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html}
}Credit the source
Original reporting: The Hacker News, “SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft”, https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html(opens in a new tab)
Follow this story
Get Cybersecurity in your inbox — new stories in 40 words or fewer, once a week.
Subscribe