CVE-2026-89105: CWE-1188: Initialization of a Resource with an Insecure Default in SAP_SE SAP/cloud-security-services-integration-library

The vulnerability identified as CVE-2026-89105 affects the HybridTokenAuthenticator component within the SAP/cloud-security-services-integration-library. The issue arises because the component accepts tokens from unintended ambient IAS/XSUAA bindings, which are not meant to be accepted. This behavior is due to insecure default initialization of a resource (CWE-1188). The flaw could allow an attacker to gain unauthorized access by presenting tokens that should be rejected, thereby breaching security controls. The CVSS v3.1 base score is 4.2, indicating a medium severity with network attack vector, high attack complexity, low privileges required, no user interaction, and low impact on confidentiality and integrity, with no impact on availability.

An attacker could use tokens from unintended ambient IAS/XSUAA bindings to gain unauthorized access to the system. This unauthorized access could lead to partial confidentiality and integrity loss. There is no indication of availability impact. The vulnerability does not appear to be actively exploited in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Users should monitor SAP advisories for updates and apply any official fixes once released. Until then, review token acceptance configurations to ensure tokens are only accepted from intended bindings if possible.