UAA vulnerabilities

3 known vulnerabilities in UAA from Cloud Foundry. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.6 High severity

  UAA: Improper Authentication

  CVE-2026-59358Oct 6, 2026Cloud Foundry

  Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presentin

• 8.7 High severity

  UAA: Improper Handling of Case Sensitivity

  CVE-2026-59335Aug 25, 2026Cloud Foundry

  Improper handling of case sensitivity (CWE-178) in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that th

• 9.0 Critical severity

  UAA: Improper Verification of Cryptographic Signature

  CVE-2026-41005Jun 11, 2026Cloud Foundry

  Cloud Foundry UAA incorrectly treated XML encryption to the Service Provider (confidentiality) as a substitute for XML signatures from the Identity Provider (authenticity) in two SAML flows: the OAuth 2.0 SAML2 bearer grant (token endpoint) and browser SSO (AC