Tests find SAP credential-protection check missing from six later SDK releases

Six SAP Cloud SDK for Python releases after an August security fix omit its tenant-name check when applications use the Destination service module, The Hacker News found. Its October 13 tests identified the gap in versions 0.53.0 through 0.55.0; version 0.55.1 restored the check. SAP disclosed that an attacker controlling a tenant subdomain could redirect authentication requests to an attacker-controlled server, exposing an application's client ID and secret. The advisory names version 0.45.2 as the fix. The six later releases failed 9 of SAP's 11 validation tests. The advisory lists no version above 0.45.2 as affected and does not clarify whether those releases fall under CVE-2026-89111.