Executive brief
Cloud Foundry's User Authentication and Authorization (UAA) service contains a critical security flaw in how it handles identity verification. The system incorrectly assumes that if a login message is encrypted, it must be from a trusted source, even if it lacks a digital signature. This allows an attacker to create their own encrypted messages using publicly available keys to bypass authentication and gain unauthorized access to the platform.
Technical details
A signature verification bypass exists in Cloud Foundry UAA's SAML implementation. The vulnerability occurs because UAA treats XML encryption (confidentiality) as a substitute for XML signatures (authenticity) in the OAuth 2.0 SAML2 bearer grant and browser SSO flows when 'wantAssertionSigned' is disabled. Because encryption uses the Service Provider's (SP) public key—which is typically public in metadata—any actor can generate ciphertext that UAA can decrypt. UAA fails to verify that the decrypted assertion was actually signed by a trusted Identity Provider (IdP), allowing an attacker to forge assertions and bypass authentication. Users should upgrade to uaa_release v78.15.0 or CF Deployment v57.0.0.
Affected products
- Cloud Foundry UAA (uaa_release) 2.0.0 through 78.13.0
- Cloud Foundry CF Deployment through 56.1.0
Timeline
- 2026-06-11: disclosed
- 2026-06-11: advisory