SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft

A critical CVSS 10.0 vulnerability in SAP's Cloud SDK for Python allowed attackers to hijack OAuth2 client credentials by manipulating tenant subdomains to redirect authentication requests to malicious servers. What makes this incident particularly serious is that SAP initially patched the flaw in version 0.45.2, but a patch regression inadvertently reintroduced the vulnerability in versions 0.53.0 through 0.55.0 — meaning organizations that updated their software believed they were protected when they were not. This highlights two compounding risks: the danger of OAuth2 credential theft in multi-tenant cloud environments, and the often-overlooked hazard of regression bugs in security patches. Stolen OAuth2 credentials can grant attackers persistent, broad access to cloud resources, potentially affecting all tenants of a compromised application. Organizations must treat patch validation and regression testing as a core part of their vulnerability management lifecycle, not an afterthought.