CVE-2026-89105: Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library

Published Oct 13, 2026

Updated

The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security.

Affected Software

1 affected component

SAP cloud-security-services-integration-library

Event History

Oct 13, 2026

CVE Published

via MITRE·12:23 AM

Data Sourced

via MITRE·12:23 AM

DescriptionSeverity

Data Sourced

via NVD·01:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The attacker needs network access and low-level privileges, and exploitation is rated as high complexity. The attack relies on presenting tokens from unintended ambient IAS or XSUAA bindings that the affected component accepts.

What is the expected security impact?

Successful exploitation can grant unauthorized access. The reported impact includes limited disclosure and modification of data, with no availability impact indicated.

Are default configurations known to be affected?

The available information does not state whether a default configuration is affected. Exposure is specifically associated with use of the HybridTokenAuthenticator component and acceptance of tokens from unintended ambient IAS/XSUAA bindings.

CVE-2026-89105: Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

Are default configurations known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the expected security impact?

Are default configurations known to be affected?