# CVE-2026-41005: Cloud Foundry UAA authentication bypass via SAML signature validation failure

Source: https://junglewise.ai/threats/cve-2026-41005-cloud-foundry-uaa-authentication-bypass-via-saml-signature  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-11. Updated: 2026-06-11  
License: CC BY 4.0 with a link back

CVE-2026-41005 · Severity: critical · CVSS 9 · Published 2026-06-11

Cloud Foundry's User Authentication and Authorization (UAA) service contains a critical security flaw in how it handles identity verification. The system incorrectly assumes that if a login message is encrypted, it must be from a trusted source, even if it lacks a digital signature. This allows an attacker to create their own encrypted messages using publicly available keys to bypass authentication and gain unauthorized access to the platform.

Technologies: [Cloud Foundry UAA](https://junglewise.ai/threats/technologies/uaa). Vendors: [Cloud Foundry](https://junglewise.ai/threats/vendors/cloud-foundry).

## Quick answers

**Is CVE-2026-41005 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41005 being exploited in the wild.

**How severe is CVE-2026-41005?** Critical severity, with a CVSS score of 9, published 11 June 2026.

**Which products and versions are affected?** Cloud Foundry UAA 2.0.0 through 78.13.0.

**Is there a fix for CVE-2026-41005?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-41005 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-41005?** Check whether you run Cloud Foundry UAA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A signature verification bypass exists in Cloud Foundry UAA's SAML implementation. The vulnerability occurs because UAA treats XML encryption (confidentiality) as a substitute for XML signatures (authenticity) in the OAuth 2.0 SAML2 bearer grant and browser SSO flows when 'wantAssertionSigned' is disabled. Because encryption uses the Service Provider's (SP) public key—which is typically public in metadata—any actor can generate ciphertext that UAA can decrypt. UAA fails to verify that the decrypted assertion was actually signed by a trusted Identity Provider (IdP), allowing an attacker to forge assertions and bypass authentication. Users should upgrade to uaa_release v78.15.0 or CF Deployment v57.0.0.

## Affected products

- Cloud Foundry UAA (uaa_release) 2.0.0 through 78.13.0
- Cloud Foundry CF Deployment through 56.1.0

## Timeline

- 2026-06-11: disclosed
- 2026-06-11: advisory

## References

- [https://www.cloudfoundry.org/blog/cve-2026-41005-uaa-accepts-saml-encrypted-assertions-authentication-bypass/](https://www.cloudfoundry.org/blog/cve-2026-41005-uaa-accepts-saml-encrypted-assertions-authentication-bypass/)

## Related threats

- [Cloud Foundry UAA denial-of-service in private_key_jwt client-authentication](https://junglewise.ai/threats/cve-2026-59396-a-denial-of-service-vulnerability-exists-in-uaa-s-private-key-jwt)
- [Cloud Foundry UAA OAuth token endpoint authentication bypass](https://junglewise.ai/threats/cve-2026-59358-improper-authentication-cwe-287-in-the-oauth-token-endpoint-in)
- [Cloud Foundry UAA OIDC callback token validation bypass](https://junglewise.ai/threats/cve-2026-59357-insufficient-verification-of-data-authenticity-cwe-345-in-the)
- [Cloud Foundry UAA OIDC scope escalation via externalGroupsWhitelist bypass](https://junglewise.ai/threats/cve-2026-47839-cloud-foundry-uaa-oidc-scope-escalation-via)
- [Cloud Foundry UAA authorization bypass via case sensitivity in identity zone endpoint](https://junglewise.ai/threats/cve-2026-59335-cloud-foundry-uaa-authorization-bypass-via-case-sensitivity-in)