Skip to content
OpenAdvisories

Product · Cloud Foundry

UAA

9 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 4.9
    CVE-2026-59396

    DoS Vulnerability in UAA Related to JWKS URI Handling

    A denial-of-service vulnerability exists in UAA's private_key_jwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker …

    Cloud Foundry CF Deployment UAA
  • Medium 6.5
    CVE-2026-59357

    Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions

    Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated ext…

    Cloud Foundry CF Deployment UAA
  • Medium 6.6
    CVE-2018-11082

    Cloud Foundry UAA MFA does not prevent brute force of MFA code

    Cloud Foundry UAA, all versions prior to 4.20.0 and Cloud Foundry UAA Release, all versions prior to 61.0, allows brute forcing of MFA codes. A remote unauthenticated malicious user in possession of a valid username and password can brute force MFA to login a…

    Cloud Foundry UAA UAA Release