CVE-2026-89111: Critical SAP Cloud SDK SSRF
SAP disclosed CVE-2026-89111, a CVSS 10 SSRF in SAP Cloud SDK for Python that can leak OAuth2 secrets.
3
Stories per day · 30 days
1 RSS
5 stories, newest first · one card per story
Stories tagged #oauth2
SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft
SAP's Python Cloud SDK can leak OAuth2 client secrets through tenant-subdomain SSRF, tracked as CVSS 10.0 CVE-2026-89111.
CVE-2026-73179: Apache CXF: JPA authorization-code consume is non-atomic
Apache CXF's JPA OAuth2 provider can reuse one authorization code (CVE-2026-73179).
CVE-2026-92288: Lemonldap::NG::Portal versions from 2.20.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow unauthenticated OAuth2 token introspection because checkEndPointAuthenticationCredentials does not verify the client secret of a public Relying Party
CVE-2026-92288 allows unauthenticated OAuth2 token introspection in LemonLDAP::NG when public client secrets go unchecked.
CVE-2026-87802: Apache Syncope: SRA OAuth2 JWT signature verification bypass
Low-severity CVE-2026-87802 in Apache Syncope SRA allows JWT signature forgery in OAuth 2.0 setups without JWKS URI.