The solution on my side is to use the --sso option.
cf login --sso -a https://api.cf.us10.hana.ondemand.com
Afterwards you will be prompted to get a passcode from this url: https://login.cf.us10.hana.ondemand.com/passcode
However, for me this failed several times.
The key is to use alternative identity provider on the login screen
and enter sap.ids as provider when you already have an SAP Universal login

Sadly, this does not work when using trial version in API endpoint https://api.cf.us10-001.hana.ondemand.com . I already opened a support request.