CVE-2026-59357: UAA 4.5.0 through 79.6.0; +1 more affected products

Affected technology

UAA · 4.5.0 through 79.6.0
Cloud Foundry

cf-deployment · 0 through 60.4.0
Cloud Foundry

Description’s affected range: v4.5.0 to v79.6.0 (inclusive)

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · Active user interaction

What an attacker can do

An authenticated UAA user can bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting a UAA access token or a cross-client ID token as the callback’s id_token parameter. Vendor/CNA’s CVSS 4.0 assessment (base score 6.5/10) rates confidentiality and integrity impact as high; availability impact as none.