Cloud Foundry UAA is vulnerable to a bypass that permits an attacker to obtain a token for any user and gain access to UAA‑protected systems. The flaw exists because, when SAML 2.0 bearer assertions are enabled, the UAA accepts assertions that are neither signed nor encrypted, violating the expected authentication guarantees. The result is full impersonation of any user, elevating the risk to confidentiality and integrity of all protected data.

The vulnerability affects Cloud Foundry UAA versions from v77.30.0 through v78.7.0, inclusive, and also applies to CF Deployment releases from v48.7.0 to v54.14.0. Systems running any of these releases remain susceptible unless client configurations explicitly disable or enforce signing and encryption of bearer assertions.

The CVSS score of 8.6 indicates high severity. While the EPSS score is not available and the vulnerability is not listed in CISA's KEV catalog, the attack vector is inferred to be through crafted SAML 2.0 bearer assertions sent to the UAA over the network, implying remote exploitation without local access. The flaw provides direct token acquisition, enabling unrestricted access to protected APIs and services.