Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted. This issue affects UUA from v77.30.0 to v78.7.0 (inclusive) and it affects CF Deployment from v48.7.0 to v54.14.0 (inclusive).
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-16 | 1 | Disclosure1 |
| 2026-04-17 | 2 | Disclosure2 |
CVE-2026-22734 Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists… https://www.cve.org/CVERecord?id=CVE-2026-22734
Post summary
CVE-2026-22734 is publicly disclosed as a bypass in Cloud Foundry UAA that lets attackers acquire arbitrary user tokens and access protected systems.
CVE-2026-22734 Authentication Bypass in Cloud Foundry UAA via Unsigned SAML 2.0 Bearer Assertions https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-22734
Post summary
The text references CVE‑2026‑22734, noting an authentication bypass via unsigned SAML 2.0 bearer assertions, but provides only descriptive details without any PoC, exploit, or patch information.
CVE-2026-22734 | Cloud Foundry UUA | Vulnerability Description Cloud Foundry UUA SAML 2.0 signature bypass allows unauth attackers to obtain tokens for any user and access UAA-protected systems by submitting unsigned, unencrypted SAML 2.0 bearer assertions when enabled for a client, affecting UUA v77.30.0 to v78.7.0 and CF Deployment v48.7.0 to v54.14.0. Severity: High Exploitation: Unknown Public PoC: Unknown Patch Available: Yes Affected Product: Cloud Foundry UUA Affected Version: >= v77.21.0 and <= v78.8.0 Sources Research: https://www.cloudfoundry.org/blog/cve-2026-22734-uaa-saml-2-0-signature-bypass/
Post summary
Cloud Foundry UUA is vulnerable to a SAML 2.0 signature bypass that lets unauthenticated attackers obtain tokens; a patch is available, but no PoC or active exploitation has been reported.