{"schema":"threatline.record/2","record":{"id":"CVE-2026-59357","aliases":[],"summary":"Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions","details":"Insufficient verification of data authenticity (CWE-345) in the external OIDC login callback in Cloud Foundry UAA v4.5.0 to v79.6.0 (inclusive) allows an authenticated UAA user to bypass the OAuth authorization-code exchange and establish an authenticated external-OIDC browser session, via submitting a UAA access token or a cross-client ID token as the callback’s id_token parameter.\n\n\n\nThe issue only manifests when a UAA zone is configured with an OIDC identity provider whose issuer exactly matches that zone’s own /oauth/token endpoint (a “self-UAA” OIDC configuration). In this configuration, the callback takes a supplied id_token directly instead of requiring the authorization code exchange, and does not verify that the token was actually issued as an ID token for the specific self-OIDC relying-party client. An attacker holding any valid UAA JWT for themselves — including a plain access token with only uaa.user scope, or a valid ID token issued to an unrelated client such as cf — can present it as the callback’s id_token and be authenticated into a mapped local (“shadow”) account. Because the resulting session is not verified against the originating token’s true audience or user_id, its effective privilege depends entirely on the shadow account’s group memberships, which can include administrative scopes such as clients.write.\n\n\n\nExploitation requires a valid UAA user JWT, a valid browser login state for the target zone, and the presence of a self-referential OIDC provider configuration — this is not a pre-authentication vulnerability, and does not by itself grant privileges beyond those already held by the mapped shadow account.","categories":["Unclassified"],"product":"UAA","vendor":"Cloud Foundry","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-59357","source_modified_at":"2026-10-06T11:49:21.187Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"UAA","vendor":"Cloud Foundry","versions":[{"status":"affected","version":"4.5.0","lessThanOrEqual":"79.6.0","versionType":"semver"},{"status":"unaffected","version":"79.7.0","versionType":"semver"}],"defaultStatus":null},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-59357","source_modified_at":"2026-10-06T11:49:21.187Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"cf-deployment","vendor":"Cloud Foundry","versions":[{"status":"affected","version":"0","lessThanOrEqual":"60.4.0","versionType":"semver"},{"status":"unaffected","version":"60.5.0","versionType":"semver"}],"defaultStatus":null}],"fixed_versions":[],"cvss":6.5,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00185,"percentile":0.0768,"score_date":"2026-10-23"},"published_at":"2026-10-06T07:06:18.486Z","modified_at":"2026-10-06T11:49:21.187Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-59357","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-10-06T11:49:21.187Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-59357","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://www.cloudfoundry.org/blog/cve-2026-59357-self-uaa-oidc-configuration-allows-jwt-injection-to-establish-unauthorized-sessions/"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"total","assessed_at":"2026-10-06T11:47:58.110314Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-06T11:49:21.187Z","content_hash":"c9d6bc6fd87c7767a6b916489c6b4dcc597cbf977b1dd0f08f1e12e5e6258f6f"}}