CVE-2026-59357: Cloud Foundry UAA OIDC callback token validation bypass

CVE-2026-59357 · Severity: info · Published 2026-10-06

Cloud Foundry UAA is an authentication and authorization system for enterprise applications. In configurations using external OIDC providers (a specific setup where the OIDC issuer matches the UAA itself), an authenticated user can bypass the normal OAuth token exchange and gain access as a different user account. An attacker with any valid UAA authentication token can exploit this to potentially access elevated-privilege accounts if mapped shadows exist with administrative rights.

Technologies: Cloud Foundry UAA. Vendors: Cloud Foundry.

Quick answers

Is CVE-2026-59357 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59357 being exploited in the wild.
How severe is CVE-2026-59357?
Informational severity, published 6 October 2026.
Which products and versions are affected?
Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive.
Is there a fix for CVE-2026-59357?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-59357 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-59357?
Check whether you run Cloud Foundry UAA at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is insufficient verification of id_token authenticity in the OIDC login callback (CWE-345). When a UAA zone is configured as a self-referential OIDC provider, the callback accepts any supplied id_token without verifying it was actually issued as an ID token for the specific relying-party client, allowing an authenticated attacker to reuse their own access token or an unrelated client's ID token. Exploitation requires a valid UAA JWT and active browser session; the resulting privilege escalation depends on shadow account group memberships.

Affected products

  • Cloud Foundry UAA v4.5.0 to v79.6.0 inclusive

Timeline

  • 2026-10-06: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.