CVE-2025-22216 — CVE-2025-22216 UAA Missing Zone Validation
A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP can re-use their …
Published: 2025-01-31 · CVSS: 5.4 · CVSS 3.1
A UAA configured with multiple identity zones, does not properly validate session information across those zones. A User authenticated against a corporate IDP can re-use their jsessionid to access other zones.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7