CyberRota Analysis
AI-GeneratedA critical vulnerability exists in systems using a federated OpenID Connect (OIDC) provider, allowing authenticated users to gain unauthorized access to the uaa.admin scope, even when restricted by the externalGroupsWhitelist configuration. This occurs when the OIDC identity provider employs groupMappingMode: AS_SCOPES with a wildcard entry, potentially leading to privilege escalation. Organizations utilizing OIDC for user authentication should prioritize addressing this issue to mitigate the risk of unauthorized access to sensitive administrative functions.
Original NVD Description
A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS_SCOPES with a wildcard externalGroupsWhitelist entry.