Session Information Vulnerability in Multi-Zone UAA by Cloud Foundry

CVE-2025-22216

What is CVE-2025-22216?

The affected UAA configuration with multiple identity zones fails to validate session information adequately. This security flaw allows a user authenticated against a corporate Identity Provider (IDP) to reuse their jsessionid, potentially gaining unauthorized access to other zones. This misconfiguration can lead to significant security implications, as it enables the compromise of sensitive data across different identity zones.

References