Severity
High
CVSS score: 7.6 (High) (CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N)
Vendor
Cloud Foundry Foundation
Versions Affected
*Severity is High unless otherwise noted.
UAA
– All versions from UAA v3.7.0 to v79.6.0 (inclusive);
CF Deployment
– All versions to v60.4.0 (inclusive)
Description
Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret.
UAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret.
Exploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client.
Mitigation
Users of affected products are strongly encouraged to follow the mitigations below.
The Cloud Foundry project recommends upgrading the following releases:
UAA
– Upgrade UAA versions to v79.7.0 or greater
CF Deployment
– Upgrade cf-deployment version to v60.5.0 or greater
– Includes UAA v79.7.0
As an interim mitigation prior to upgrading, audit OAuth client configurations and ensure no client simultaneously supports both a public user-facing authorization flow and the client_credentials grant type, and restrict administrative authorities such as clients.write to dedicated, non-public clients.
Credit
This issue was responsibly reported by Minseong Kim (mak3bread).
History
2026-10-05: Initial vulnerability report published.
