This vulnerability in Cloud Foundry Foundation UAA permits users authenticating through a federated OpenID Connect (OIDC) provider to obtain the uaa.admin scope even when operators have restricted that provider via the externalGroupsWhitelist configuration. The flaw specifically arises when the OIDC identity provider uses the groupMappingMode AS_SCOPES in conjunction with a wildcard entry in the externalGroupsWhitelist, bypassing intended access controls. The issue affects UAA versions up to 77.30.0 and 48.9.0. The CVSS 4.0 vector indicates network attack vector, high complexity, partial privileges required, no user interaction, and high impacts on confidentiality, integrity, and availability.

An attacker authenticating through a federated OIDC provider can escalate privileges to obtain the uaa.admin scope, potentially gaining administrative control over UAA. This bypasses operator-imposed restrictions intended to limit group membership and scope assignment, leading to unauthorized administrative access. The vulnerability is rated critical with a CVSS score of 9.2, reflecting the high severity of unauthorized privilege escalation in an authentication system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, operators should avoid using wildcard entries in the externalGroupsWhitelist configuration when using groupMappingMode AS_SCOPES with federated OIDC providers. Review and tighten OIDC provider configurations to prevent unintended scope assignments.