Vulnerability in Cloud Foundry Uua
CVE-2026-22734
Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted. This issue affects UUA from v77.30.0 to v78.7.0 (inclusive) and it affects CF Deployment from v48.7.0 to v54.14.0 (inclusive).
EPSS: 0.004 (29.0th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N.
Affected products
- Cloud Foundry Uua — versions v77.21.0
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-22734?
- CVE-2026-22734 is a high-severity vulnerability in Cloud Foundry Uua, classified under Authentication Bypass by Spoofing. CVSS score: 8.6/10. Published 2026-04-17.
- How severe is CVE-2026-22734?
- High severity. CVSS v3 base score is 8.6 out of 10.