CVE-2026-59396

A denial-of-service vulnerability exists in UAA's privatekeyjwt client-authentication mechanism. When UAA retrieves a remote JWKS URI, it caches the response. Invalid authentication attempts can trigger full deserialization of this cached data. An attacker with prerequisites write access to clien...