Search
Find a vulnerability
Search criteria
2 vulnerabilities found for UUA by Cloud Foundry
CVE-2026-22734 (GCVE-0-2026-22734)
Vulnerability from nvd – Published: 2026-04-16 23:33 – Updated: 2026-04-17 13:21
VLAI
Title
Cloud Foundry UAA SAML 2.0 Signature Bypass
Summary
Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted. This issue affects UUA from v77.30.0 to v78.7.0 (inclusive) and it affects CF Deployment from v48.7.0 to v54.14.0 (inclusive).
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-290 - Authentication bypass by spoofing
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Foundry | UUA |
Affected:
v77.21.0 , ≤ v78.8.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22734",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-17T13:20:57.232084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-17T13:21:04.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UUA",
"vendor": "Cloud Foundry",
"versions": [
{
"lessThanOrEqual": "v78.8.0",
"status": "affected",
"version": "v77.21.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cloud Foundry UUA is\u003cspan\u003e\u0026nbsp;vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eThis issue affects UUA\u003c/span\u003e\u003cspan\u003e\u0026nbsp;from v77.30.0 to v78.7.0 (inclusive)\u0026nbsp;\u003c/span\u003e\u003cspan\u003eand it affects\u0026nbsp;\u003c/span\u003e\u003cspan\u003eCF Deployment\u0026nbsp;\u003c/span\u003e\u003cspan\u003efrom v48.7.0 to v54.14.0 (inclusive).\u003c/span\u003e"
}
],
"value": "Cloud Foundry UUA is\u00a0vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted.\u00a0This issue affects UUA\u00a0from v77.30.0 to v78.7.0 (inclusive)\u00a0and it affects\u00a0CF Deployment\u00a0from v48.7.0 to v54.14.0 (inclusive)."
}
],
"impacts": [
{
"capecId": "CAPEC-646",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-646 Peripheral Footprinting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication bypass by spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T23:33:43.596Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://www.cloudfoundry.org/blog/cve-2026-22734-uaa-saml-2-0-signature-bypass/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cloud Foundry UAA SAML 2.0 Signature Bypass",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22734",
"datePublished": "2026-04-16T23:33:43.596Z",
"dateReserved": "2026-01-09T06:54:41.498Z",
"dateUpdated": "2026-04-17T13:21:04.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-22734 (GCVE-0-2026-22734)
Vulnerability from cvelistv5 – Published: 2026-04-16 23:33 – Updated: 2026-04-17 13:21
VLAI
Title
Cloud Foundry UAA SAML 2.0 Signature Bypass
Summary
Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted. This issue affects UUA from v77.30.0 to v78.7.0 (inclusive) and it affects CF Deployment from v48.7.0 to v54.14.0 (inclusive).
Severity
8.6 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-290 - Authentication bypass by spoofing
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Cloud Foundry | UUA |
Affected:
v77.21.0 , ≤ v78.8.0
(custom)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-22734",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-17T13:20:57.232084Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-17T13:21:04.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UUA",
"vendor": "Cloud Foundry",
"versions": [
{
"lessThanOrEqual": "v78.8.0",
"status": "affected",
"version": "v77.21.0",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Cloud Foundry UUA is\u003cspan\u003e\u0026nbsp;vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted.\u0026nbsp;\u003c/span\u003e\u003cspan\u003eThis issue affects UUA\u003c/span\u003e\u003cspan\u003e\u0026nbsp;from v77.30.0 to v78.7.0 (inclusive)\u0026nbsp;\u003c/span\u003e\u003cspan\u003eand it affects\u0026nbsp;\u003c/span\u003e\u003cspan\u003eCF Deployment\u0026nbsp;\u003c/span\u003e\u003cspan\u003efrom v48.7.0 to v54.14.0 (inclusive).\u003c/span\u003e"
}
],
"value": "Cloud Foundry UUA is\u00a0vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted.\u00a0This issue affects UUA\u00a0from v77.30.0 to v78.7.0 (inclusive)\u00a0and it affects\u00a0CF Deployment\u00a0from v48.7.0 to v54.14.0 (inclusive)."
}
],
"impacts": [
{
"capecId": "CAPEC-646",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-646 Peripheral Footprinting"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-290",
"description": "CWE-290 Authentication bypass by spoofing",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-16T23:33:43.596Z",
"orgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"shortName": "vmware"
},
"references": [
{
"url": "https://www.cloudfoundry.org/blog/cve-2026-22734-uaa-saml-2-0-signature-bypass/"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Cloud Foundry UAA SAML 2.0 Signature Bypass",
"x_generator": {
"engine": "Vulnogram 1.0.1"
}
}
},
"cveMetadata": {
"assignerOrgId": "dcf2e128-44bd-42ed-91e8-88f912c1401d",
"assignerShortName": "vmware",
"cveId": "CVE-2026-22734",
"datePublished": "2026-04-16T23:33:43.596Z",
"dateReserved": "2026-01-09T06:54:41.498Z",
"dateUpdated": "2026-04-17T13:21:04.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}