CVE-2026-59358

Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA (affected versions not specified)

Description Improper authentication in the OAuth token endpoint allows a remote, authenticated attacker with a valid user access token to obtain a fully-privileged client credentials token for the OAuth client that issued it. This occurs because the system fails to verify that the Bearer credential supplied for client authentication is a legitimate client secret or configured authentication method, accepting any valid access token where the client id matches the request. An attacker can replay a user token—originally obtained via a public authorization code and PKCE flow—as Bearer authentication on a client credentials grant request. This results in the issuance of a new token with the client's full authorities, such as clients.write, enabling the creation of arbitrary new OAuth clients with attacker-chosen authorities. Exploitation requires a client configured to support both a public user-facing authorization flow and the client credentials grant type on the same client id.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.