The vulnerability is a case of insufficient verification of data authenticity (CWE‑345) in the external OpenID Connect (OIDC) login callback of Cloud Foundry UAA. An authenticated UAA user can supply an arbitrary JWT as the callback’s id_token parameter, bypassing the normal OAuth authorization‑code exchange. Because the callback does not verify that the supplied token was issued as an ID token for the intended relying‑party client, the attacker can establish an authenticated external‑OIDC browser session. The resulting session is bound only to the mapped local “shadow” account; if that account has elevated scopes such as clients.write, the attacker gains those privileges. This flaw requires the attacker to have a valid UAA JWT and an active browser login session for the zone, so it is not a pre‑authentication vulnerability but it enables privilege escalation within the user’s mapped account.

Affected products include Cloud Foundry UAA versions from 4.5.0 to 79.6.0 inclusive, deployed in Cloud Foundry zones configured with a self‑referential OIDC identity provider whose issuer matches the zone’s /oauth/token endpoint. The issue manifests only when a UAA zone is set up with this specific self‑OIDC configuration. All other OIDC configurations are unaffected.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, so the current probability of exploitation is unknown, and the vulnerability is not listed in the CISA KEV catalog. The most likely attack vector is through a web browser interacting with the OIDC callback endpoint; the attacker must first possess a valid UAA JWT and an existing authenticated session in the target zone. If these conditions are met, the attacker can inject a token and gain access via the shadow account. The impact is limited to the privileges of the shadow account but can be significant if the account has administrative scopes.