# Tests find SAP credential-protection check missing from six later SDK releases

_Published Tuesday, October 13, 2026 at 3:20 PM EDT · Security · Latest · Tier 2 — Notable_

![Tests find SAP credential-protection check missing from six later SDK releases — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgKBZR5elkBVKRcFO6lyde7XYDVO73IBxDvnx9-UkLst3GhVFuK8Yz3QBVIIEJABDjZuJMn8tyf7RLLPIRV8J8qe-OUULjnQRaQNyWricSsOjlKJoyYu8WOvs5PxBWQpzuiq8hlDlOY7zY-qIYDgQ6NFuifS5GbHbnLBET0OTfmsMC8797Mo5un9_ECyg8/s1700-nu-rw-lo-l85-e365/sap-hacker.jpg)

Six SAP Cloud SDK for Python releases after an August security fix omit its tenant-name check when applications use the Destination service module, The Hacker News found. Its October 13 tests identified the gap in versions 0.53.0 through 0.55.0; version 0.55.1 restored the check.

SAP disclosed that an attacker controlling a tenant subdomain could redirect authentication requests to an attacker-controlled server, exposing an application's client ID and secret. The advisory names version 0.45.2 as the fix.

The six later releases failed 9 of SAP's 11 validation tests. The advisory lists no version above 0.45.2 as affected and does not clarify whether those releases fall under CVE-2026-89111.

## Sources

- [The Hacker News](https://thehackernews.com/2026/10/sap-discloses-critical-cvss-10-flaw-in.html)

---
Canonical: https://techandbusiness.org/newswire/P5jZXdD88l8BmBSMsXjkaE
Published: 2026-10-13T19:20:05.219Z
Story chronology: 2026-10-13T17:28:00.000Z
Retrieved: 2026-10-13T21:50:22.551Z
Publisher: Tech & Business (techandbusiness.org)