Advisories · Technology
Cloud Foundry UAA.
Every CVE that names Cloud Foundry UAA among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.9 Medium
DoS Vulnerability in UAA Related to JWKS URI Handling
- Cloud Foundry UAA
- Cloud Foundry cf-deployment
- Denial of service
- CVSS 6.5 Medium
Self-UAA OIDC Configuration allows JWT injection to establish unauthorized sessions
- Cloud Foundry UAA
- Cloud Foundry cf-deployment
- CWE-345
- CVSS 7.6 High
UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
- Cloud Foundry UAA
- Cloud Foundry cf-deployment
- Authentication bypass
- CVSS 8.7 High
Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise
- Cloud Foundry UAA
- Cloud Foundry cf-deployment
- CWE-178
- CVSS 9.0 CriticalCritical · CVSS 9+
UAA accepts SAML Encrypted Assertions authentication bypass
- Cloud Foundry UAA
- Cloud Foundry CF Deployment
- Weak cryptography or TLS
- CVSS 3.0 Low
CVE-2025-22246 – UAA Private Key Exposure
- Cloud Foundry UAA
- Cloud Foundry CF deployment
- Information disclosure
- CVSS 5.4 Medium
CVE-2025-22216 UAA Missing Zone Validation
- Cloud Foundry UAA
- Authentication bypass
- CVSS 8.8 High
UAA fails to check the state parameter when authenticating with external IDPs
- Cloud Foundry UAA
- Cross-site request forgery (CSRF)
- CVSS 6.6 Medium
Cloud Foundry UAA MFA does not prevent brute force of MFA code
- Cloud Foundry UAA Release
- Cloud Foundry UAA
-
An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v257; UAA release 2.x versions prior to v2.7.4.14, 3.6.x versions prior to v3.6.8, 3.9.x versions prior to v3.9.10, an…
- Cloud Foundry UAA