The HybridTokenAuthenticator in the SAP cloud-security-services-integration-library accepts authentication tokens issued for IAS/XSUAA bindings that are not intended for the target service. This flaw permits an attacker to use a token that should be rejected, thereby gaining unauthorized access to protected resources. The weakness is a clear example of improper authentication, enabling privilege escalation within the system without requiring valid user credentials.

The vulnerability affects SAP SE's cloud-security-services-integration-library component. No specific version constraints are listed in the advisory, so any deployment of the library that contains the flawed HybridTokenAuthenticator may be impacted.

The CVSS score of 4.2 indicates a moderate severity. There is no EPSS score available, and the issue is not in CISA's KEV catalog, implying no known widespread exploitation. The likely attack vector is the use of a forged or incorrectly bound token within the same system or an environment that shares IAS/XSUAA bindings with the vulnerable library. Because token acceptance is performed internally, the attacker can bypass standard authentication controls if the flawed token is presented to the authenticator.