Authentication Bypass in Cloud Foundry UAA Impacts Service Provider Integrity

CVE-2026-41005

What is CVE-2026-41005?

The vulnerability in Cloud Foundry UAA arises from improper handling of XML encryption, where the system mistakenly treats encrypted content as a valid substitute for authenticity provided by XML signatures. This flaw is present in two specific SAML flows: the OAuth 2.0 SAML2 bearer grant and browser SSO, particularly when wantAssertionSigned is set to false. Unsigned assertions that contain encrypted content can be processed by UAA, raising serious concerns about the trustworthiness of the identity provider (IdP). Since the encryption uses the service provider's public key, any entity could create ciphertext that UAA would decrypt, leading to unauthorized access.

References