Oauth2 on CuraSechttps://curasec.metacog.co.kr/tags/oauth2/Recent content in Oauth2 on CuraSecHugoen-usTue, 13 Oct 2026 18:14:34 +0000SAP patches max-severity SSRF flaw in Cloud SDK for Python (Oct 2026)https://curasec.metacog.co.kr/insights/2026-10-13-sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw/Tue, 13 Oct 2026 18:14:34 +0000https://curasec.metacog.co.kr/insights/2026-10-13-sap-warns-of-maximum-severity-oauth2-ssrf-security-flaw/<ul> <li><strong>Engineer — Plan:</strong> Maximum-severity SSRF in SAP Cloud SDK for Python could allow unauthenticated server-side request forgery via the OAuth2 layer; patch is available but no KEV listing or public PoC. Update SAP Cloud SDK for Python to the October 2026 patched release this sprint, and audit any internal-only endpoints reachable from BTP workloads.</li> <li><strong>SOC/IR — Skip</strong></li> <li><strong>Leader — Skip</strong></li> </ul>