Vulnerabilities in pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

PACKAGE
Advisory Identifier: GHSA-6wcw-r64p-qrrw
Share
Advisory Summary

CVE-2026-22723 is a MODERATE (CVSS 6.5) cloudfoundry uaa has logic error vulnerability (General Security Weakness) affecting Cloudfoundry identity server libraries in the Maven ecosystem. The issue involves cloudfoundry uaa has logic error in the token revocation endpoint implementation. Remediation is available by upgrading affected packages to version 78.8.0.

21 Known Advisory Record(s)
Package Vulnerability Intelligence

pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server

21 Known Advisory Record(s)

Vulnerability advisories affecting package pkg:maven/org.cloudfoundry.identity/cloudfoundry-identity-server. Select an advisory below to view technical details or fixes.

Advisory ID CVE / NVD Severity Summary
GHSA-6wcw-r64p-qrrw CVE-2026-22723 MODERATE Cloudfoundry UAA has logic error in the token revocation endpoint implementation
GHSA-xh4m-99qp-w483 CVE-2018-11041 MODERATE Cloud Foundry UAA open redirect
GHSA-r4v8-9hgx-vm6m CVE-2018-11047 HIGH Cloud Foundry UAA accepts refresh token as access token on admin endpoints
GHSA-j97q-9xp9-g5fx CVE-2018-1190 MODERATE Pivotal Cloud Foundry UAA XSS on UAA OpenID Connect check session iframe endpoint
GHSA-xg5v-696h-c3vr CVE-2018-1192 HIGH Cloud Foundry UAA SessionID present in Audit Event Logs
GHSA-8v97-gv3g-32rf CVE-2018-1262 HIGH UAA privilege escalation across identity zones
GHSA-292x-hjr8-226f CVE-2018-15761 HIGH Cloud Foundry UAA Privilege Escalation
GHSA-cw9c-v3v2-99hm CVE-2017-4974 MODERATE Blind SQL Injection with privileged Cloud Foundry UAA endpoints
GHSA-pgjc-gc7g-p2c6 CVE-2017-4973 HIGH Cloud Foundry UAA Privilege Escalation
GHSA-cgrg-x34r-78f3 CVE-2017-4991 HIGH Cloud Foundry UAA password reset vulnerability
GHSA-jcmh-x32v-7mgf CVE-2017-4992 CRITICAL Cloud Foundry UAA privilege escalation with user invitations
GHSA-j4p3-2m2h-cv5f CVE-2017-8031 MODERATE Cloud Foundry UAA Denial of Service through client token revocation endpoint
GHSA-9frw-wmvq-5rrc CVE-2017-8032 MODERATE Cloud Foundry UAA Identity Zone Admin Privilege Escalation
GHSA-hxgw-7539-pv7r CVE-2017-4960 HIGH Cloud Foundry denial of service vulnerability
GHSA-4m8c-h7fr-gq5c CVE-2016-6637 CRITICAL Cloud Foundry vulnerable to Cross-Site Request Forgery
GHSA-rc2r-w8jv-vggp CVE-2016-5016 MODERATE Cloud Foundry vulnerable to Improper Certificate Validation
GHSA-fm5c-2rwc-887w CVE-2016-3084 HIGH Cloud Foundry UAA reset password vulnerable to brute force attack
GHSA-cq6m-74r4-x77g CVE-2015-5172 CRITICAL Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
GHSA-h533-q6jc-qx28 CVE-2015-5171 CRITICAL Cloud Foundry Runtime Insufficient Session Expiration vulnerability
GHSA-mpv3-g527-fqrj CVE-2015-5170 HIGH Cloud Foundry Runtime Cross-Site Request Forgery vulnerability
GHSA-fj69-p8f6-q97h CVE-2015-3189 LOW Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password

CVE-2026-22723 at a Glance

CVE Identifier CVE-2026-22723
GHSA Identifier GHSA-6wcw-r64p-qrrw
Severity MODERATE
CVSS v3.1 Base Score 6.5
CWE Classification General Security Weakness
Affected Product Cloudfoundry identity server
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 6.5

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality None (C:N)
Integrity None (I:N)
Availability High (A:H)

How to Fix CVE-2026-22723

To remediate this vulnerability, upgrade all affected Cloudfoundry identity server dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

org.cloudfoundry.identity:cloudfoundry-identity-server fixed: 78.8.0 
<dependency>
    <groupId>org.cloudfoundry.identity</groupId>
    <artifactId>cloudfoundry-identity-server</artifactId>
    <version>78.8.0</version>
</dependency>
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree -Dincludes=org.cloudfoundry.identity

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-22723, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree -Dincludes=org.cloudfoundry.identity

Analyze the terminal output to locate any version of Cloudfoundry identity server in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 78.8.0), your application is affected.

Note: The mvn dependency:tree -Dincludes=org.cloudfoundry.identity command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Cloudfoundry identity server, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.

CVE-2026-22723 Affected Cloudfoundry identity server Versions

1 component(s)
Fixed Versions:
78.8.0
Product / Package Ecosystem Affected Versions Fixed Version
org.cloudfoundry.identity:cloudfoundry-identity-server
maven/org.cloudfoundry.identity/cloudfoundry-identity-server
Maven
≥ 77.30.0
< 78.8.0
78.8.0

References

NVD — CVE-2026-22723 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-22723
Security Fix Commit FIX COMMIT
https://github.com/cloudfoundry/uaa/commit/74c88235b5bc6e61752624700e91f61fd724dfcd
Cloudfoundry identity server Source Repository REPOSITORY
https://github.com/cloudfoundry/uaa
Cloudfoundry identity server Release RELEASE
https://github.com/cloudfoundry/uaa/releases/tag/v78.8.0
www.cloudfoundry.org/blog/cve-2026-22723... WEB
https://www.cloudfoundry.org/blog/cve-2026-22723-uaa-user-token-revocation

Frequently Asked Questions

What is CVE-2026-22723?
CVE-2026-22723 is a security vulnerability in Cloudfoundry identity server involving Cloudfoundry UAA has logic error in the token revocation endpoint implementation under General Security Weakness.
Which Cloudfoundry identity server versions are affected?
Affected versions include releases prior to 78.8.0 across affected packages: org.cloudfoundry.identity:cloudfoundry-identity-server.
What version fixes CVE-2026-22723?
Upgrading to 78.8.0 (or the latest patched release for your respective branch) resolves the vulnerability.
Is cloudfoundry-identity-server affected?
Yes, org.cloudfoundry.identity:cloudfoundry-identity-server is affected in releases prior to 78.8.0. Upgrade your dependency to 78.8.0 or later.
What is the CVSS score of CVE-2026-22723?
CVE-2026-22723 has a CVSS v3.1 base score of 6.5 (MODERATE) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H.
What CWE is associated with CVE-2026-22723?
CVE-2026-22723 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-22723?
Run the dependency tree command: 'mvn dependency:tree -Dincludes=org.cloudfoundry.identity'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-6wcw-r64p-qrrw",
  "modified" : "2026-03-09T14:11:56Z",
  "published" : "2026-03-05T21:30:49Z",
  "aliases" : [ "CVE-2026-22723" ],
  "summary" : "Cloudfoundry UAA has logic error in the token revocation endpoint implementation",
  "details" : "Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.cloudfoundry.identity:cloudfoundry-identity-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "77.30.0"
      }, {
        "fixed" : "78.8.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-22723"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cloudfoundry/uaa/commit/74c88235b5bc6e61752624700e91f61fd724dfcd"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/cloudfoundry/uaa"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/cloudfoundry/uaa/releases/tag/v78.8.0"
  }, {
    "type" : "WEB",
    "url" : "https://www.cloudfoundry.org/blog/cve-2026-22723-uaa-user-token-revocation"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-09T14:11:56Z",
    "nvd_published_at" : "2026-03-05T21:16:14Z"
  }
}