CVE-2026-89105

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-89105
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89105.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-89105
Aliases
  • GHSA-857v-p42q-f3qf
Published
2026-10-13T00:23:29Z
Modified
2026-10-14T07:07:41Z
Severity
  • 4.2 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N CVSS Calculator
Summary
Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library
Details

The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from unintended ambient IAS/XSUAA bindings, potentially allowing unauthorized access. This vulnerability allows an attacker to gain unauthorized access to the system by using tokens that should not be accepted, leading to a breach of security.

Database specific 
{
    "cna_assigner":  "sap",
    "cwe_ids":  [
        "CWE-1188"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/89xxx/CVE-2026-89105.json"
}
References

Affected packages

Git / github.com/sap/cloud-security-services-integration-library

Affected ranges

Type
GIT
Repo
https://github.com/sap/cloud-security-services-integration-library
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5427e4048cc3aaede3bd4579a682eb10b728e7d9
Introduced
699d25fb05260ce1cdfb9785bedc1a507ba711ef
Last Affected
699d25fb05260ce1cdfb9785bedc1a507ba711ef
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "4.1.1"
        },
        {
            "introduced":  ">=3.6.6"
        },
        {
            "last_affected":  ">=3.6.6"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

3.*
3.6.6
>=3.*
>=3.6.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-89105.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "60669495974043388576167764024103084948",
                "120583206917388745418230427667523198271",
                "97851956628542106208391573821870151553",
                "88090704687362470276315781980746217056"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-89105-126c837e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/sap/cloud-security-services-integration-library/commit/5427e4048cc3aaede3bd4579a682eb10b728e7d9",
        "target":  {
            "file":  "java-security/src/main/java/com/sap/cloud/security/token/validation/validators/SapIdJwtSignatureValidator.java"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "234416634111984147361960009296303392865",
            "length":  1297
        },
        "id":  "CVE-2026-89105-872b61dc",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/sap/cloud-security-services-integration-library/commit/5427e4048cc3aaede3bd4579a682eb10b728e7d9",
        "target":  {
            "file":  "java-security/src/main/java/com/sap/cloud/security/token/validation/validators/SapIdJwtSignatureValidator.java",
            "function":  "getPublicKey"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "305873645195509646153251462098336492283",
                "179134928726512949003303421125024903088",
                "18868246008798107065705189901879867131",
                "335391923332883398951730313256478179123"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-89105-e779cdad",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/sap/cloud-security-services-integration-library/commit/5427e4048cc3aaede3bd4579a682eb10b728e7d9",
        "target":  {
            "file":  "java-security/src/test/java/com/sap/cloud/security/token/validation/validators/SapIdJwtSignatureValidatorTest.java"
        }
    }
]
vanir_signatures_modified 
"2026-10-14T07:07:41Z"