Cloud Foundry UAA, versions 60 before 66.0, contain an authorization logic error. In environments with multiple identity providers that contain accounts across identity providers with the same username, a remote authenticated user with access to one of these accounts may be able to obtain a token for an account of the same username in the other identity provider.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
pivotal software cloud foundry uaa-release |
Vulmon