CVE-2026-22723: Cloudfoundry Identity Server Token Revocation Logic Error
Summary
CVE-2026-22723: Cloudfoundry UAA has logic error in the token revocation endpoint implementation. Affects org.cloudfoundry.identity:cloudfoundry-identity-server versions >= 77.30.0, < 78.8.0. Fixed in 78.8.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Cloudfoundry Identity Server is a critical component of the Cloudfoundry platform, providing authentication and authorization services. It manages user identities and access tokens for applications deployed on the Cloudfoundry infrastructure. The server is designed to ensure secure access control, but vulnerabilities can compromise its integrity and the security of applications relying on it.
Vulnerability Detail
The vulnerability arises from a logic error in the token revocation endpoint implementation of Cloudfoundry UAA versions 77.30.0 to 78.7.0 and Cloudfoundry Deployment versions 48.7.0 to 54.10.0. This flaw can lead to inappropriate user token revocation, potentially allowing unauthorized access to sensitive resources. If exploited, attackers could misuse valid tokens, leading to data breaches or unauthorized actions within the system.
How To Fix
Latest published version: 4.30.0 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
78.8.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you may consider implementing additional access controls or monitoring token usage to detect any unauthorized access attempts until the patch can be applied.
Conclusion
In summary, CVE-2026-22723 presents a significant risk to the Cloudfoundry Identity Server due to a logic error in the token revocation process. It is crucial to update to the patched version to mitigate this vulnerability and ensure the security of your applications.
See every vulnerability recorded for org.cloudfoundry.identity:cloudfoundry-identity-server →
FAQ
CVE-2026-22723 is a vulnerability in the Cloudfoundry Identity Server that allows for inappropriate user token revocation due to a logic error.
The affected versions are Cloudfoundry UAA v77.30.0 to v78.7.0 and Cloudfoundry Deployment v48.7.0 to v54.10.0.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 6.5, indicating a moderate severity level.
If an immediate update is not possible, consider implementing additional security measures, such as monitoring token usage and restricting access to sensitive resources.
Related vulnerabilities
Recent vulnerabilities recorded for org.cloudfoundry.identity:cloudfoundry-identity-server.
