10 matches found
CVE-2026-59335
Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...
CVE-2026-59335 Case-Sensitive Authorization Check Bypass via Identity Zone ID Case Manipulation Leads to Full UAA Compromise
Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...
EUVD-2026-65466
Improper handling of case sensitivity CWE-178 in the identity zone authorization check in the Identity Zone Endpoint in Cloud Foundry UAA allows a remote authenticated attacker holding only the zones.write authority to bypass the intended restriction that this authority does not grant access to t...
CVE-2026-59335
Cloud Foundry UAA is affected by an authorization bypass (CWE-178) in its Identity Zone Endpoint . The root cause is a mismatch between the application's case-sensitive zone identifier comparison and MySQL's case-insensitive default collation: an attacker holding only zones.write can reference th...
PT-2026-81263
Name of the Vulnerable Software and Affected Versions Cloud Foundry UAA affected versions not specified Description Improper handling of case sensitivity in the identity zone authorization check within the Identity Zone Endpoint allows a remote authenticated attacker with zones.write authority to...
CVE-2026-59335 - UAA case insensitive check bypass | Cloud Foundry
Severity CVSSv4.0 – 7.7 — CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSSv3.1 – 8.7 — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N Vendor CloudFoundry Foundation Versions Affected Severity is High unless otherwise noted. UAA All versions prior to v78.16.0 CF Deployment All...
ANT-2026-S8PHCV74 · cloudfoundry/uaa · auth_bypass
auth-bypass medium Severity Claude high · Security research firm medium · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-S8PHCV74: DenyAccessToUaaAdvice case-sensitive check bypassed on MySQL: zones.write overwrites syste...
External Authentication - Moderately critical - Access bypass - SA-CONTRIB-2026-098
This module enables you to authenticate Drupal users against external identity providers. The module does not sufficiently ensure exact matching of externally supplied identity values when storing and looking up authentication mappings under certain database collation configurations. This...
Improper Handling of Case Sensitivity
Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in authorization checks. A user can obtain an authorization decision meant for a different identity by issuing a check for a user string that differs only in letter case from an authorized one,...