# Federated cloud role accepts the wrong workload identity

OIDC role trust accepts a legitimate token from a disallowed controlled subject, repository, branch or audience.

**Candidate CWE:** [CWE-863](https://cwe.mitre.org/data/definitions/863.html)

## Test hypothesis

Use the owned identity provider's normal token issuance to create allowed and disallowed fixture identities. Attempt the same role exchange and canary operation, changing one claim dimension at a time.

## Evidence required

Redacted issuer/audience/subject claims, trust policy, session role and allowed/denied control. Keep full tokens out of the report.

## Rule out false positives

A token merely decodes successfully, a wildcard covers only the intended trust set, or the provider rejects the exchange before any authority is obtained.

## Playbook and command references

- [Cloud IAM: trust, delegation and effective permissions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/cloud-iam-boundaries.html) — Prove which principal can act on which resource, including cross-account trust, delegated roles and workload federation.
- [Azure and GCP: identity, delegation and storage access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/azure-gcp-boundaries.html) — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Cloud%20IAM%3A%20trust%2C%20delegation%20and%20effective%20permissions)

## Referenced by these target playbooks

[Cloud & containers](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/cloud.html) · [OSS & self-hosted](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/oss.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

- [T1078.004 · Valid Accounts: Cloud Accounts](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html#T1078-004) — **Only if:** A controlled reproduction uses compromised or misused valid cloud credentials/accounts to gain access or exceed the account's intended role; identify the specific observed goal. **Not established by:** The existence of a cloud account, a suspected leaked key, or authorized use of a researcher account is not enough. The official tactic list does not mean all four goals occurred.

## Primary references

- [AWS OIDC role federation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_create_for-idp_oidc.html)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)