{"id":"CVE-2026-109799","published":"2026-11-10T01:17:13.887","lastModified":"2026-11-10T20:17:38.000","description":"The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and user_uuid claims from the IAS JWT in the Authorization header using an unverified decoder and wrote them into the request-scoped RuntimeContext without validating the token signature. A remote caller could submit a self-signed JWT naming a victim tenant/user; the forged identity then propagated to every consumer of the runtime context:OTel span attributes (sap.tenancy.tenant_id, user.id) via RuntimeContextSpanProcessorlog records via IdentityLogFilteraudit events (tenant_id, user_initiator_id) via AuditClienttenant routing via CBCClientThis completes an earlier remediation that fixed the same unverified pattern in StarletteIASTelemetryMiddleware but did not cover IASContextProvider.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-93m8-crj2-v997","tags":[]},{"url":"https://url.sap/sapsecuritypatchday","tags":[]}],"exploitRefs":[{"url":"https://github.com/SAP/cloud-sdk-python/security/advisories/GHSA-93m8-crj2-v997","tags":[]}],"hasPoc":true,"ai":null}