CVE-2020-5402: high-severity vulnerability in Cloud Foundry UAA
UAA fails to check the state parameter when authenticating with external IDPs
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.5%
In Cloud Foundry UAA, versions prior to 74.14.0, a CSRF vulnerability exists due to the OAuth2 state parameter not being checked in the callback function when authenticating with external identity providers.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Cloud Foundry · UAARelated CVEs — Cloud Foundry UAA
In the same product, most dangerous first.
CVE-2018-15761CRITICALUAA Privilege EscalationEPSS 1.7%CVE-2018-11082MEDIUMCloud Foundry UAA MFA does not prevent brute force of MFA codeEPSS 1.1%CVE-2026-59335HIGHCase-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA CompromiseEPSS 0.5%CVE-2026-59358HIGHUAA OAuth Token Endpoint Vulnerability allows user access token reuse for client_credentials grant typeEPSS 0.4%CVE-2026-59396MEDIUMDoS Vulnerability in UAA Related to JWKS URI HandlingEPSS 0.3%CVE-2025-22246LOWCVE-2025-22246 – UAA Private Key ExposureEPSS 0.2%