CVE-2026-22734
SAML Assertion Bypass in Cloud Foundry UAA Enables Unauthorized Access
Publication date: 2026-04-17
Last updated on: 2026-04-17
Assigner: VMware
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| cloud_foundry | uua | From 77.30.0 (inc) to 78.7.0 (inc) |
| cloud_foundry | cf_deployment | From 48.7.0 (inc) to 54.14.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-290 | This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects Cloud Foundry UUA when SAML 2.0 bearer assertions are enabled for a client. The issue arises because the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted, allowing an attacker to bypass normal authentication controls.
As a result, an attacker can obtain a token for any user, which grants unauthorized access to systems protected by UAA.
How can this vulnerability impact me? :
The vulnerability allows an attacker to impersonate any user by obtaining their token without proper authentication.
- Unauthorized access to UAA-protected systems.
- Potential exposure of sensitive data due to compromised user tokens.
- Increased risk of privilege escalation and unauthorized actions within the affected environment.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to obtain a token for any user and gain unauthorized access to UAA-protected systems by exploiting the acceptance of unsigned and unencrypted SAML 2.0 bearer assertions.
Such unauthorized access can lead to exposure of sensitive personal or protected health information, potentially violating data protection requirements under standards like GDPR and HIPAA.
Therefore, this vulnerability could negatively impact compliance with these regulations by compromising confidentiality and access controls mandated by them.