User Account and Authentication
9 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for User Account and Authentication, a product in the cloud saas space. Use it to gauge the current risk picture and drill into individual advisories.
User Account and Authentication CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 9 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- High5
- Medium4
Latest CVEs
The 9 most recently published vulnerabilities affecting User Account and Authentication.
- CVE-2023-20903This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity provider is linked to the UAA, a refresh token is issued to ...4.3
- CVE-2021-22098UAA server versions prior to 75.4.0 are vulnerable to an open redirect vulnerability. A malicious user can exploit the open redirect vulnerability by social engineering leading to take over of vict...6.1
- CVE-2021-22001In UAA versions prior to 75.3.0, sensitive information like relaying secret of the provider was revealed in response when deletion request of an identity provider( IdP) of type “oauth 1.0” was ...7.5
- CVE-2020-5402UAA fails to check the state parameter when authenticating with external IDPs8.8
- CVE-2019-11293UAA logs all query parameters with debug logging level6.5
- CVE-2019-11290Cloud Foundry UAA logs query parameters in tomcat access file7.5
- CVE-2019-11278Privilege Escalation via Blind SCIM Injection in UAA8.8
- CVE-2019-11274UAA SCIM Filter XSS6.1
- CVE-2016-0732The identity zones feature in Pivotal Cloud Foundry 208 through 229; UAA 2.0.0 through 2.7.3 and 3.0.0; UAA-Release 2 through 4, when configured with multiple identity zones; and Elastic Runtime 1....8.8
Product grouping is registry-driven, with AI assist and human review. How it works