The SAP Cloud SDK for Python contains an OAuth2 server-side request forgery (SSRF) vulnerability affecting the SDK's use within multi-tenant SAP Business Technology Platform (BTP) applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials to be exfiltrated. Affects versions before 0.45.2; SAP rated the flaw CVSS 10.0 (critical).