CVE-2026-41005 is an improper verification of cryptographic signature vulnerability (CWE-347) in Cloud Foundry UAA. The product incorrectly treats XML encryption to the Service Provider as a substitute for XML signatures from the Identity Provider in two SAML flows: OAuth 2.0 SAML2 bearer grant and browser SSO (ACS) when wantAssertionSigned is false. Because encryption uses the Service Provider's public key, any party can produce ciphertext that UAA can decrypt, so successful decryption does not guarantee the message was issued by a trusted Identity Provider. This allows acceptance of unsigned assertions or responses containing encrypted content, undermining authenticity guarantees.

An attacker can craft unsigned SAML assertions or responses with encrypted content that UAA will accept as authentic, potentially allowing unauthorized access or impersonation in affected SAML flows. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector. This compromises the trust model of authentication and authorization in Cloud Foundry UAA deployments using these SAML flows with wantAssertionSigned set to false.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround is currently documented. Until a fix is available, administrators should consider enforcing wantAssertionSigned=true in SAML configurations to require signed assertions or responses, thereby avoiding reliance on encryption as a substitute for signature verification.