# CVE-2026-59358: UAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant type

> Authenticated users can bypass client authentication to obtain privileged client credentials, enabling privilege escalation and arbitrary client creation in Cloud Foundry UAA.

- **Severity:** High 7.6 (`CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N`)
- **Exploited in the wild:** Not known
- **Login needed:** Any signed-in user
- **Attackable:** Over the internet
- **Victim action needed:** Not needed
- **Fix available:** No
- **Published:** 6 Oct 2026
- **Updated:** 6 Oct 2026
- **Also known as:** GHSA-hqp7-g6vh-8mf8

## What is CVE-2026-59358?

CVE-2026-59358 is a high-severity authentication bypass vulnerability in Cloud Foundry UAA, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

### Official description

Improper authentication (CWE-287) in the OAuth token endpoint in Cloud Foundry UAA allows a remote, authenticated attacker holding a valid user access token to obtain a fully-privileged client_credentials token for the OAuth client that issued it, by presenting the user token as an OAuth 2.0 Bearer credential on a client_credentials grant request in place of the client’s configured secret.

UAA’s client_credentials handling does not verify that the Bearer credential supplied for client authentication is actually a client credential (a client secret or a valid configured client authentication method); it accepts any valid access token whose client_id matches the request. A token obtained by a normal end user through a public authorization_code + PKCE flow — scoped only to uaa.user, carrying a user_id, and recording client_auth_method=none — satisfies this check. That user token cannot itself administer OAuth clients (POST /oauth/clients correctly returns 403), but when replayed as Bearer authentication on a client_credentials request for the same client, UAA issues a new client-only token carrying the client’s full authorities, such as clients.write. An attacker can use that token to create arbitrary new OAuth clients, including clients with attacker-chosen authorities, without ever possessing the client’s actual secret.

Exploitation requires a valid user access token (the attacker’s own) for a client that is configured to support both a public, user-facing authorization flow and the client_credentials grant type on the same client_id — a non-default combination. Practical impact scales with the authorities assigned to that client.

Weakness: CWE-287 (Improper Authentication)

## Which versions are affected by CVE-2026-59358?


## How do I fix CVE-2026-59358?

No fix has been published for CVE-2026-59358 yet. Limit exposure of the affected software until one is available.

## Is CVE-2026-59358 being exploited?

There is no known exploitation of CVE-2026-59358 in the wild and no public exploit code.

Public exploit code:

- CVE-2026-59358 - Cloud Foundry UAA - High - Remote - Privilege leftover - user PKCE token as client_credentials Bearer (github_poc): https://github.com/abraxas/CVE-2026-59358

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-59358 and fix it if it is affected.

What it is: CVE-2026-59358 is a high-severity authentication bypass vulnerability in Cloud Foundry UAA, published on 6 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-59358 in the wild and no public exploit code.

Affected product: Cloud Foundry UAA. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-59358/ (Markdown: https://insights.sbomify.com/CVE-2026-59358/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-59358
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-59358
- OSV: https://osv.dev/vulnerability/CVE-2026-59358

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-59358/
Summaries are generated and may contain mistakes; the official description above is the record.