CVE-2026-59357

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA versions 4.5.0 through 79.6.0

Description Insufficient verification of data authenticity in the external OIDC login callback allows an authenticated user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session. This occurs when a UAA zone is configured with an OIDC identity provider whose issuer matches the zone's own /oauth/token endpoint. In this scenario, the callback accepts a supplied id token without verifying if it was issued as an ID token for the specific relying-party client. An attacker with a valid UAA JWT, such as a plain access token with uaa.user scope or an ID token for an unrelated client, can use it as the id token parameter to authenticate into a mapped local shadow account. The resulting privileges are determined by the shadow account's group memberships, which may include administrative scopes like clients.write.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.