I found OAuth credential exposure flaws in the official MCP Python and TypeScript SDKs. Why patching CVE-2026-115563 and CVE-2026-104850 may not be enough.
Six SAP Cloud SDK for Python releases skip tenant checks in Destination calls, enabling OAuth2 client secret leaks if attackers control tenant names.
Some results have been hidden because they may be inaccessible to you
Show inaccessible results