CVE-2026-89105
4.2MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-1188
Impact
Authenticated attackers can gain unauthorized access to protected application resources. They need valid credentials or tokens issued by unintended ambient IAS or XSUAA bindings.
Root cause
The HybridTokenAuthenticator component inadvertently validates and accepts tokens originating from unintended ambient service bindings.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade the SAP cloud-security-services-integration-library dependency to the patched version specified in GHSA-857v-p42q-f3qf. If patching immediately is not possible, review and remove unnecessary ambient IAS/XSUAA service bindings in your application environment.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security.