CVE-2026-47839: UAA OIDC Auth Bypass Vulnerability

CVE-2026-47839 Overview

CVE-2026-47839 is an access control vulnerability in Cloud Foundry User Account and Authentication (UAA) that allows federated OpenID Connect (OIDC) users to obtain the uaa.admin scope. The flaw bypasses the externalGroupsWhitelist restriction operators use to limit which external groups map into UAA scopes. The condition is triggered when an OIDC identity provider uses groupMappingMode: AS_SCOPES combined with a wildcard entry in externalGroupsWhitelist. Successful exploitation grants full administrative privileges over the UAA server, including user, client, and token management. The weakness is classified as Improper Access Control [CWE-284].

Critical Impact

Federated OIDC users can escalate to uaa.admin, gaining full administrative control over the UAA authorization server and every application relying on it for identity.

Affected Products

• Cloud Foundry UAA deployments configured with a federated OIDC identity provider
• OIDC providers configured with groupMappingMode: AS_SCOPES
• UAA installations using a wildcard externalGroupsWhitelist entry

Discovery Timeline

• 2026-09-11 - CVE-2026-47839 published to the National Vulnerability Database (NVD)
• 2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-47839

Vulnerability Analysis

UAA supports federated authentication through external OIDC identity providers. Operators use externalGroupsWhitelist to control which external groups are honored during scope mapping. When an OIDC provider is configured with groupMappingMode: AS_SCOPES, group claims returned by the identity provider are treated directly as UAA scopes rather than as group memberships requiring translation.

The access control failure occurs when the whitelist contains a wildcard entry. Under this configuration, UAA does not filter the scope-mapped values against an explicit allow list. An authenticated federated user whose OIDC token carries a uaa.admin value in the group claim receives that scope on their UAA token. The design intent of externalGroupsWhitelist — restricting which external identifiers can influence UAA authorization — is defeated.

Once a session holds uaa.admin, the attacker can create clients, mint tokens, reset passwords, and modify identity provider configuration. This provides persistent control over authentication for every workload trusting the UAA.

Root Cause

The root cause is improper enforcement of the whitelist when scope mapping runs in AS_SCOPES mode. Wildcard configuration is interpreted permissively, so any group value received from the OIDC provider is accepted as a valid UAA scope without membership validation against an operator-defined set.

Attack Vector

Exploitation requires an attacker to authenticate through the federated OIDC provider and control or influence the group claim issued to their identity. Where the identity provider allows self-service group creation, group naming, or claim customization, the attacker inserts uaa.admin as a group value. UAA accepts the resulting token and issues administrative scope. The attack is remote and requires no prior UAA privilege.

Refer to the Cloud Foundry advisory for the vendor description of the affected configuration.

Detection Methods for CVE-2026-47839

Indicators of Compromise

• UAA audit events showing federated OIDC users receiving tokens that include the uaa.admin scope.
• Creation of new OAuth clients, identity providers, or admin users shortly after a federated login event.
• Unexpected password resets, secret rotations, or SAML/OIDC provider modifications performed by non-administrative identities.
• Token issuance events where the scope claim contains privileged UAA scopes that were not previously observed for the subject.

Detection Strategies

• Inventory all UAA identity providers and flag any using groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.
• Alert on any UAA token issuance where a federated user obtains scopes beginning with uaa. or scim..
• Correlate OIDC provider group claims against a known-good list of UAA scopes and flag mismatches.

Monitoring Recommendations

• Forward UAA audit logs and token issuance events to a centralized log platform for continuous review.
• Track administrative UAA API calls, including client creation, user modification, and identity provider changes, by originating identity.
• Review the frequency and source of uaa.admin scope grants weekly, and investigate any grant issued to a federated subject.

How to Mitigate CVE-2026-47839

Immediate Actions Required

• Identify UAA identity providers configured with groupMappingMode: AS_SCOPES and remove wildcard entries from externalGroupsWhitelist.
• Replace wildcards with an explicit list of external group names that should map to UAA scopes.
• Revoke active tokens for federated OIDC users and force re-authentication after remediation.
• Review recent UAA administrative activity for signs of unauthorized configuration changes or client creation.

Patch Information

Apply the fixed UAA release referenced in the Cloud Foundry advisory for CVE-2026-47839. Operators should upgrade UAA to the patched version and validate identity provider configuration after upgrade.

Workarounds

• Remove wildcard values from externalGroupsWhitelist and enumerate acceptable group names explicitly.
• Switch the affected OIDC provider away from groupMappingMode: AS_SCOPES to a mode that requires internal scope translation.
• Restrict the OIDC provider so that end users cannot influence the group claim values delivered in tokens.
• Rotate UAA signing keys and client secrets if unauthorized uaa.admin scope issuance is suspected.

# Configuration example: remove wildcard, enumerate allowed groups explicitly
# UAA identity provider config snippet (YAML)
externalGroupsWhitelist:
  - cf.admin
  - cf.developer
  - cf.auditor
config:
  groupMappingMode: EXPLICITLY_MAPPED