CVE-2026-41005 describes a vulnerability in Cloud Foundry UAA where XML encryption is incorrectly used as a substitute for XML signature verification in two SAML flows: the OAuth 2.0 SAML2 bearer grant and browser SSO when wantAssertionSigned is false. Since encryption uses the Service Provider's public key, any party can create encrypted content that UAA decrypts, but successful decryption does not prove the message was issued by a trusted Identity Provider. This flaw allows acceptance of unsigned assertions or responses, undermining authenticity guarantees.

This vulnerability allows an attacker to bypass the intended cryptographic signature verification in affected SAML flows, potentially enabling unauthorized access or token issuance by submitting unsigned but encrypted assertions or responses. The impact includes complete compromise of confidentiality, integrity, and availability of authentication tokens and sessions, as reflected by the CVSS score of 9.0 (critical).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider enforcing wantAssertionSigned=true in SAML configurations to require signed assertions and responses, thereby mitigating the risk of accepting unsigned encrypted content.