SAP Cloud SDK for Python Flaw Enables OAuth2 Credential Theft
Critical vulnerability allows attacker-controlled tenant subdomains to intercept OAuth2 client secrets
Key Takeaways
- Critical CVSS 10.0 vulnerability in SAP Cloud SDK for Python allows OAuth2 credential theft.
- Attacker must control the tenant subdomain to exploit the flaw.
- Affected systems: multi-tenant applications on SAP Business Technology Platform using the Python SDK.
- SAP has released patches; updating the SDK and reviewing redirect URIs is strongly advised.
Related Security News
Palo Alto Networks PAN-OS RCE Zero-Day Exploited in Real-World Attacks
Palo Alto Networks has released security updates to address a high-severity remote code execution vulnerability in PAN-OS, tracked as CVE-2026-0322. The flaw has been exploited in attacks targeting firewall devices. The company has urged administrators to apply the latest software versions to mitigate the risk of compromise.
Microsoft October 2026 Patch Tuesday Addresses Record 1,411 Vulnerabilities Including Actively Exploited Zero-Day
Microsoft released security updates on October 13, 2026, as part of its monthly Patch Tuesday cycle, addressing 1,411 vulnerabilities across its product portfolio. The update includes one zero-day vulnerability reported as actively exploited in the wild and two additional zero-days that have been publicly disclosed. The volume of flaws fixed represents a record-breaking monthly patch cycle for the company.
