CVE-2026-59357: CWE-345: Insufficient Verification of Data Authenticity in Cloud Foundry UAA
Description
Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting a UAA access token or a cross-client ID token as the callback’s id_token parameter. The issue only manifests when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that zone’s own /oauth/token endpoint (a “self-UAA” OIDC configuration). In this configuration, the callback takes a supplied id_token directly instead of requiring the authorization code exchange, and does not verify that the token was actually issued as an ID token for the specific self-OIDC relying-party client. An attacker holding any valid UAA JWT for themselves — including a plain access token with only uaa.user scope, or a valid ID token issued to an unrelated client such as cf — can present it as the callback’s id_token and be authenticated into a mapped local (“shadow”) account. Because the resulting session is not verified against the originating token’s true audience or user_id, its effective privilege depends entirely on the shadow account’s group memberships, which can include administrative scopes such as clients.write. Exploitation requires a valid UAA user JWT, a valid browser login state for the target zone, and the presence of a self-referential OIDC provider configuration — this is not a pre-authentication vulnerability, and does not by itself grant privileges beyond those already held by the mapped shadow account.
CVSS v4.0
Score 6.5medium
Affected software
Cloud Foundry
UAA
Cloud Foundry
cf-deployment
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-59357) in Cloud Foundry UAA affects versions 4.5.0 to 79.6.0 and 0 to 60.4.0. It arises from insufficient verification of data authenticity (CWE-345) in the external OIDC login callback when a UAA zone is configured with an OIDC identity provider whose issuer matches the zone's own /oauth/token endpoint (self-UAA OIDC configuration). In this scenario, the callback accepts a supplied id_token directly without requiring the OAuth authorization code exchange and fails to verify that the token was issued for the specific relying-party client. An attacker with any valid UAA JWT (including access tokens with minimal scopes or ID tokens issued to unrelated clients) can present it as the id_token parameter to authenticate into a mapped local shadow account. The resulting session's privileges depend on the shadow account's group memberships, which may include administrative scopes. Exploitation requires possession of a valid UAA JWT and a valid browser login state for the target zone, and the vulnerability does not elevate privileges beyond those of the shadow account. This is not a pre-authentication vulnerability.
Potential Impact
An authenticated UAA user with a valid JWT can bypass the OAuth authorization-code exchange in self-referential OIDC configurations, allowing them to establish an authenticated external-OIDC browser session as a mapped shadow account. The effective privileges depend on the shadow account's group memberships, which can include administrative scopes such as clients.write. This does not grant new privileges beyond those already held by the shadow account and requires a valid user JWT and browser login state. There is no indication of known exploits in the wild.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should review their UAA zone configurations to avoid self-referential OIDC identity provider setups where the issuer matches the zone's own /oauth/token endpoint. Restricting or auditing group memberships of shadow accounts can reduce potential privilege misuse. Monitor vendor communications for updates and apply official patches once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- vmware
- Date Reserved
- 2026-07-04T18:14:46.172Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ac4a0da2cdf04f656898e2e
Added to database: 10/06/2026, 07:18:50 UTC
Last enriched: 10/06/2026, 07:33:18 UTC
Last updated: 10/06/2026, 18:57:28 UTC
Views: 20
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.