Cloud Foundry Uaa vulnerabilities

• cloud foundry uaa, cf-deployment +1 more DoS Vulnerability in UAA Related to JWKS URI Handling CVE-2026-59396 6.9 MediumOctober 30, 2026
• cloud foundry uaa, cf-deployment +1 more Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions CVE-2026-59357 6.5 MediumOctober 6, 2026
• cloud foundry uaa, cf-deployment +1 more UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type CVE-2026-59358 Public exploit 7.6 HighOctober 6, 2026
• cloud foundry uaa, cf-deployment +1 more Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise CVE-2026-59335 8.7 HighAugust 25, 2026
• cloud foundry cf deployment, uaa +1 more UAA accepts SAML Encrypted Assertions authentication bypass CVE-2026-41005 9.0 CriticalJune 11, 2026
• cloud foundry uaa, cloudfoundry uaa release, cloud foundry cf deployment +1 more +3 more CVE-2025-22246 – UAA Private Key Exposure CVE-2025-22246 3.0 LowMay 13, 2025
• cloud foundry uaa CVE-2025-22216 UAA Missing Zone Validation CVE-2025-22216 5.4 MediumJanuary 31, 2025
• cloud foundry uaa, cloudfoundry cf-deployment, user account and authentication +2 more UAA fails to check the state parameter when authenticating with external IDPs CVE-2020-5402 8.8 HighFebruary 27, 2020
• cloud foundry uaa release, cloudfoundry cf-deployment, user account and authentication +2 more UAA logs all query parameters with debug logging level CVE-2019-11293 8.8 HighDecember 6, 2019
• cloud foundry uaa release, cloudfoundry cf-deployment, user account and authentication +2 more Cloud Foundry UAA logs query parameters in tomcat access file CVE-2019-11290 8.8 HighNovember 25, 2019
• pivotal software cloud foundry uaa, cloud foundry cf deployment, uaa release +1 more +3 more UAA is vulnerable to a Blind SCIM injection leading to information disclosure CVE-2019-11282 4.3 MediumOctober 23, 2019
• cloud foundry uaa release (oss), cloudfoundry uaa release +1 more Privilege Escalation via Scope Manipulation in UAA CVE-2019-11279 8.7 HighSeptember 26, 2019
• cloud foundry uaa release (oss), cloudfoundry user account and authentication +1 more Privilege Escalation via Blind SCIM Injection in UAA CVE-2019-11278 8.7 HighSeptember 26, 2019
• cloud foundry uaa release (oss), cloudfoundry user account and authentication +1 more UAA SCIM Filter XSS CVE-2019-11274 4.3 MediumAugust 9, 2019
• pivotal software cloud foundry uaa, cloud foundry uaa release (oss), pivotal software application service +1 more +3 more UAA clients.write vulnerability CVE-2019-11270 7.3 HighAugust 5, 2019
• pivotal software cloud foundry uaa, cloud foundry uaa release (oss) +1 more UAA - Login app subject to clickjacking attack CVE-2019-3794 6.5 MediumJuly 18, 2019
• cloud foundry uaa release (oss), pivotal software cloud foundry uaa-release +1 more UAA SQL Identity Zone Vulnerability CVE-2019-11268 6.5 MediumJuly 11, 2019
• cloud foundry uaa release (oss), pivotal software cloud foundry uaa-release +1 more UAA defaults email address to an insecure domain CVE-2019-3787 8.3 HighJune 19, 2019
• cloud foundry cf-deployment, credhub, uaa release (oss) +2 more +4 more Java Projects using HTTP to fetch dependencies CVE-2019-3801 8.7 HighApril 25, 2019
• cloudfoundry uaa release, cloud foundry uaa release (oss), pivotal application service +2 more UAA redirect-uri allows wildcard in the subdomain CVE-2019-3788 8.7 HighApril 25, 2019
• cloud foundry uaa release (oss), cloudfoundry uaa release +1 more UAA allows users to modify their own email address CVE-2019-3775 7.1 HighMarch 7, 2019
• cloud foundry uaa release, pivotal software cloud foundry uaa-release +1 more UAA can issue tokens across identity providers if users with matching usernames exist CVE-2018-15754 4.2 MediumDecember 13, 2018
• cloud foundry uaa, uaa release, pivotal software cloud foundry uaa +1 more +3 more UAA Privilege Escalation CVE-2018-15761 Fix available 9.9 CriticalNovember 19, 2018
• cloud foundry uaa, uaa release, pivotal software cloudfoundry uaa +1 more +3 more Cloud Foundry UAA MFA does not prevent brute force of MFA code CVE-2018-11082 6.6 MediumOctober 5, 2018
• cloud foundry uaa, pivotal software cloud foundry uaa +1 more Cloud Foundry UAA accepts refresh token as access token on admin endpoints CVE-2018-11047 Fix available 7.5 HighJuly 24, 2018
• cloud foundry uaa, pivotal software cloud foundry uaa, cloud foundry uaa-release +2 more Cloud Foundry UAA open redirect CVE-2018-11041 Fix available 6.1 MediumJune 25, 2018
• cloud foundry cloudfoundry uaa, cloudfoundry cf-deployment, pivotal software cloud foundry uaa +1 more +3 more UAA privilege escalation across identity zones CVE-2018-1262 Fix available 7.2 HighMay 15, 2018
• cloud foundry uaa, cloudfoundry cf-release, pivotal software cloud foundry uaa +1 more +3 more Cloud Foundry UAA password reset vulnerability CVE-2017-4991 Fix available 7.2 HighJune 13, 2017
• cloud foundry uaa, cloudfoundry cf-release, pivotal software cloud foundry uaa +1 more +3 more Blind SQL Injection with privileged Cloud Foundry UAA endpoints CVE-2017-4974 Fix available 6.5 MediumJune 13, 2017
• cloud foundry uaa, pivotal software cloud foundry uaa, cloudfoundry cloud foundry uaa bosh +1 more +3 more Cloud Foundry UAA Privilege Escalation CVE-2017-4973 Fix available 8.8 HighJune 13, 2017
• cloud foundry uaa, cloudfoundry cf-release, cloud foundry uaa bosh +1 more +3 more An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA... CVE-2017-4972 7.5 HighJune 13, 2017