Insufficient Data Verification in Cloud Foundry UAA Allows Unauthorized Session Establishment

CVE-2026-59357

What is CVE-2026-59357?

A vulnerability exists in Cloud Foundry's UAA that allows authenticated users to bypass critical OAuth authorization code exchanges by exploiting insufficient data verification in the external OIDC login callback. This occurs specifically in configurations where the UAA itself is set up as an OIDC identity provider, enabling attackers to use any valid UAA JWT to authenticate into a mapped local account without the necessary verification checks. The exploitation hinges on previously held privileges, allowing the attacker to gain potentially elevated access based on the mapped shadow account's group memberships.

References