SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

SAP has disclosed a critical vulnerability in its Cloud SDK for Python, which can lead to the exposure of OAuth2 client credentials. The flaw affects multi-tenant applications on the SAP Business Technology Platform that utilize the SDK. To exploit this vulnerability, an attacker would need to have control over the tenant subdomain. This could potentially allow an attacker to intercept sensitive credentials. The vulnerability was announced in a security advisory by SAP.