CVE-2026-59396

A Denial of Service (DoS) vulnerability exists in the UAA private_key_jwt client-authentication mechanism, specifically in how it handles and caches remote JWKS URIs . When UAA fetches a remote jwks_uri, it caches the response body. An attacker with prerequisites—such as write access to clients o...