Description
Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret.



UAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret.



Exploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client.
Published: 2026-10-06
Score: 7.6 High
EPSS: < 1% Very Low
KEV: No
Impact: Privilege Escalation via token reuse
Action: Immediate Patch
AI Analysis

Impact

The vulnerability involves improper authentication in the OAuth token endpoint of Cloud Foundry UAA. A remote, authenticated attacker who holds a valid user access token can supply that token as a bearer credential on a client_credentials grant request, causing UAA to issue a new client credentials token that carries full client authorities such as clients.write. This allows the attacker to create arbitrary OAuth clients, including clients with attacker‑chosen authorities, without possessing the original client’s secret.

Affected Systems

Affected vendors include Cloud Foundry UAA and Cloud Foundry cf‑deployment. No specific version ranges are provided in the advisory, so all installations of these products should be considered potentially impacted until a patch is applied.

Risk and Exploitability

The CVSS score is 7.6, indicating a high impact. EPSS data is not available, and the vulnerability is not listed in CISA's KEV catalog. The attack requires an attacker‑owned user token for a client configured for both public authorization and client_credentials grant types. Because the flaw allows an attacker to obtain a fully privileged client token, the overall risk is high, especially when the client holds sensitive authorities. Defenses are limited until a patch or configuration change is made.

Generated by OpenCVE AI on October 6, 2026 at 08:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest Cloud Foundry UAA update that addresses the token endpoint authentication flaw.
  • Reconfigure OAuth clients to require a client secret or other approved authentication method for the client_credentials grant, ensuring bearer tokens are not accepted.
  • For clients that must support both public authorization and client_credentials grant types, remove the public authorization flow or disable client_credentials usage until the vulnerability is patched.
  • As an interim workaround, invalidate all existing user access tokens for affected clients and force users to re‑authenticate, preventing reuse of old tokens in the exploit.

Generated by OpenCVE AI on October 6, 2026 at 08:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 09 Oct 2026 08:15:00 +0000

Type Values Removed Values Added
First Time appeared Cloudfoundry
Cloudfoundry cf-deployment
Cloudfoundry uaa
Vendors & Products Cloudfoundry
Cloudfoundry cf-deployment
Cloudfoundry uaa

Tue, 06 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 07:15:00 +0000

Type Values Removed Values Added
Description Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret. UAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret. Exploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client.
Title UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type
Weaknesses CWE-287
References
Metrics cvssV4_0

{'score': 7.6, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Cloudfoundry Cf-deployment Uaa
cve-icon MITRE

Status: PUBLISHED

Assigner: vmware

Published:

Updated: 2026-10-06T14:34:25.951Z

Reserved: 2026-07-04T18:14:46.172Z

Link: CVE-2026-59358

cve-icon Vulnrichment

Updated: 2026-10-06T14:34:21.269Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-06T07:16:59.460

Modified: 2026-10-06T16:00:36.547

Link: CVE-2026-59358

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-09T08:00:04Z

Weaknesses