Threats affecting pkg:npm/@sap/ai-sdk-js

CVE-2026-120012 is a vulnerability in SAP Cloud SDK for AI (Node.js) versions up to 2.17.0 where sensitive authentication credentials may be exposed in error messages under certain failure conditions. An attacker with low privileges who can access application logs or error outputs could obtain these credentials, but exploitation requires a specific failure triggered by a higher-privileged user and is limited by the token's short lifetime. This exposure could lead to unauthorized reuse of credentials, impacting confidentiality, integrity, and availability.