CVE-2026-59358: CWE-287: Improper Authentication in Cloud Foundry UAA

The vulnerability (CWE-287) in Cloud Foundry UAA's OAuth token endpoint allows an attacker with a valid user access token to impersonate the client and obtain a client_credentials token with full client privileges. UAA accepts any valid access token whose client_id matches the request as client authentication, without verifying that it is a client credential. A user token obtained via a public authorization_code + PKCE flow can be replayed as Bearer authentication on a client_credentials grant request, resulting in issuance of a new token with full client authorities such as clients.write. This enables creation of arbitrary OAuth clients with attacker-chosen authorities without possessing the client secret. Exploitation requires a non-default client configuration supporting both public user-facing authorization and client_credentials grant types on the same client_id.

An attacker with a valid user access token for a client configured to support both public authorization and client_credentials grant types can escalate privileges to obtain a fully-privileged client_credentials token. This token grants full client authorities, including the ability to create new OAuth clients with arbitrary permissions. The severity and impact scale with the authorities assigned to the affected client. This could lead to unauthorized creation and management of OAuth clients within the UAA environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review client configurations to avoid enabling both public authorization_code + PKCE flows and client_credentials grant types on the same client_id. Restrict client authorities to the minimum necessary to reduce potential impact. Monitor for unusual client creation activity as a precaution.