CVE-2026-89105: Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library
The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs network access and low-level privileges, and exploitation is rated as high complexity. The attack relies on presenting tokens from unintended ambient IAS or XSUAA bindings that the affected component accepts.
What is the expected security impact?
Successful exploitation can grant unauthorized access. The reported impact includes limited disclosure and modification of data, with no availability impact indicated.
Are default configurations known to be affected?
The available information does not state whether a default configuration is affected. Exposure is specifically associated with use of the HybridTokenAuthenticator component and acceptance of tokens from unintended ambient IAS/XSUAA bindings.