CVE-2026-59358: UAA 3.7.0 through 79.6.0; +1 more affected products

Affected technology

UAA · 3.7.0 through 79.6.0
Cloud Foundry

cf-deployment · 0 through 60.4.0
Cloud Foundry

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret. Vendor/CNA’s CVSS 4.0 assessment (base score 7.6/10) rates confidentiality and integrity impact as high; availability impact as none.