CVE-2026-47839: Federated OIDC Users Can Bypass externalGroupsWhitelist to Gain uaa.admin
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with a wildcard externalGroupsWhitelist entry.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected by this issue?
The issue affects Pivotal Cloud Foundry UAA deployments with a federated OIDC identity provider configured with groupMappingMode: AS_SCOPES and a wildcard entry in externalGroupsWhitelist. The provided information does not indicate that other group-mapping modes or non-wildcard whitelist configurations are affected.
What does an attacker need to exploit the vulnerability?
An attacker needs to authenticate through the affected federated OIDC provider. Under the vulnerable configuration, they may obtain the uaa.admin scope despite the operator's externalGroupsWhitelist restriction.
How can operators reduce exposure before a patch is available?
Avoid the affected configuration combination: groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry for a federated OIDC provider. Review federated provider settings and remove or replace wildcard whitelist entries where possible.