{"api_version":"1","generated_at":"2026-04-17T05:47:17+00:00","cve":"CVE-2026-22734","urls":{"html":"https://cve.report/CVE-2026-22734","api":"https://cve.report/api/cve/CVE-2026-22734.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-22734","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-22734"},"summary":{"title":"Cloud Foundry UAA SAML 2.0 Signature Bypass","description":"Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted. This issue affects UUA from v77.30.0 to v78.7.0 (inclusive) and it affects CF Deployment from v48.7.0 to v54.14.0 (inclusive).","state":"PUBLISHED","assigner":"vmware","published_at":"2026-04-17 01:17:37","updated_at":"2026-04-17 01:17:37"},"problem_types":["CWE-290","CWE-290 CWE-290 Authentication bypass by spoofing"],"metrics":[{"version":"3.1","source":"security@vmware.com","type":"Secondary","score":"8.6","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"3.1","source":"CNA","type":"CVSS","score":"8.6","severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","data":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"}}],"references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-22734-uaa-saml-2-0-signature-bypass/","name":"https://www.cloudfoundry.org/blog/cve-2026-22734-uaa-saml-2-0-signature-bypass/","refsource":"security@vmware.com","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-22734","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-22734","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Cloud Foundry","product":"UUA","version":"affected v77.21.0 v78.8.0 custom","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"UUA","vendor":"Cloud Foundry","versions":[{"lessThanOrEqual":"v78.8.0","status":"affected","version":"v77.21.0","versionType":"custom"}]}],"descriptions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Cloud Foundry UUA is<span>&nbsp;vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted.&nbsp;</span><span>This issue affects UUA</span><span>&nbsp;from v77.30.0 to v78.7.0 (inclusive)&nbsp;</span><span>and it affects&nbsp;</span><span>CF Deployment&nbsp;</span><span>from v48.7.0 to v54.14.0 (inclusive).</span>"}],"value":"Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted. This issue affects UUA from v77.30.0 to v78.7.0 (inclusive) and it affects CF Deployment from v48.7.0 to v54.14.0 (inclusive)."}],"impacts":[{"capecId":"CAPEC-646","descriptions":[{"lang":"en","value":"CAPEC-646 Peripheral Footprinting"}]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":8.6,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-290","description":"CWE-290 Authentication bypass by spoofing","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-04-16T23:33:43.596Z","orgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","shortName":"vmware"},"references":[{"url":"https://www.cloudfoundry.org/blog/cve-2026-22734-uaa-saml-2-0-signature-bypass/"}],"source":{"discovery":"UNKNOWN"},"title":"Cloud Foundry UAA SAML 2.0 Signature Bypass","x_generator":{"engine":"Vulnogram 1.0.1"}}},"cveMetadata":{"assignerOrgId":"dcf2e128-44bd-42ed-91e8-88f912c1401d","assignerShortName":"vmware","cveId":"CVE-2026-22734","datePublished":"2026-04-16T23:33:43.596Z","dateReserved":"2026-01-09T06:54:41.498Z","dateUpdated":"2026-04-16T23:33:43.596Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-04-17 01:17:37","lastModifiedDate":"2026-04-17 01:17:37","problem_types":["CWE-290","CWE-290 CWE-290 Authentication bypass by spoofing"],"metrics":{"cvssMetricV31":[{"source":"security@vmware.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","baseScore":8.6,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":3.9,"impactScore":4}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"22734","Ordinal":"1","Title":"Cloud Foundry UAA SAML 2.0 Signature Bypass","CVE":"CVE-2026-22734","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"22734","Ordinal":"1","NoteData":"Cloud Foundry UUA is vulnerable to a bypass that allows an attacker to obtain a token for any user and gain access to UAA-protected systems. This vulnerability exists when SAML 2.0 bearer assertions are enabled for a client, as the UAA accepts SAML 2.0 bearer assertions that are neither signed nor encrypted. This issue affects UUA from v77.30.0 to v78.7.0 (inclusive) and it affects CF Deployment from v48.7.0 to v54.14.0 (inclusive).","Type":"Description","Title":"Cloud Foundry UAA SAML 2.0 Signature Bypass"}]}}}