CVE-2026-41005: UAA accepts SAML Encrypted Assertions authentication bypass

Synopsis

Authentication bypass in Cloud Foundry UAA (User Account and Authentication) allows a remote, unauthenticated attacker to forge SAML assertions and authenticate as any user, including administrators, without possessing credentials or a valid IdP-signed token. The flaw exists because UAA incorrectly accepted encrypted but unsigned SAML assertions, treating encryption alone as proof of authenticity. Successful exploitation grants full account takeover, including access to all data and operations the impersonated user is authorized for. Patched-image rebuilds at UAA 78.14.0 and CF Deployment 57.0.0 are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the UAA token endpoint or browser SSO ACS endpoint over the network; both are typically internet-exposed in Cloud Foundry deployments.

• AuthenticationNot required

  No credentials or prior session are needed; the attacker constructs a forged SAML assertion using the SP's publicly available encryption key.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link or take any action for exploitation to succeed.

• Attack complexityDetail

  Attack complexity is rated High because the attacker must correctly construct a well-formed encrypted SAML assertion using the SP's published public key and target a specific SAML flow configuration.

Blast Radius

• The attacker authenticates as an arbitrary user, including platform administrators, without knowing their credentials.
• With an admin-level impersonation, the attacker reads all tenant data, OAuth tokens, and user records stored in UAA.
• The attacker modifies user roles, creates new accounts, or revokes legitimate accounts across all organizations on the platform.
• The attacker disrupts authentication services for all users by altering identity provider bindings or invalidating active sessions.