WhatBrokeToday
FAQ
Today's Trends
highInvestigatingPython

SAP Cloud SDK for Python IASContextProvider Improper Cryptographic Signature Verification

  1. Investigating(current)
  2. Trending(upcoming)
  3. Workaround available(upcoming)
  4. Resolved(upcoming)

Executive summary

The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, which is registered by default via bootstrap(app). This flaw allows a remote caller to submit unverified tokens because claims are extracted from the IAS JWT using an unverified decoder without validating the signature.

No verified workaround yet

None of the linked reports describe a mitigation. Follow this incident to hear when one appears.

Official fix
Technical root cause

IASContextProvider extracted app_tid, sap_gtid, and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature.

Evidence

1 report · 1 CVEShow
  1. [1]
    CVE First report
    SAP Cloud SDK for Python: CVE-2026-109799 (High)(opens security advisory in a new tab)

    High severity. The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a…

    by Tenable 0upvotes 0comments

Timeline

  1. First report on security advisory

    SAP Cloud SDK for Python: CVE-2026-109799 (High)

    Source