What’s Vulnerable › Vulnerabilities

CVE-2026-89105: Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library

• Severity: medium (CVSS 4.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-13 · updated 2026-10-15
• Weakness: CWE-1188

Description

The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security.

Affected products

• SAP_SE SAP/cloud-security-services-integration-library: from 3.6.6; before 4.1.1

References

• https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-857v-p42q-f3qf
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2026-89105 or the next vulnerability affects your stack