Cloud Foundry UAA versions v76.12.0 through v78.12.0 contain a critical vulnerability where Elliptic Curve (EC) private keys are inadvertently exposed through the public /token_keys endpoint. This endpoint is designed to provide public key material for JWT token verification but incorrectly exposes private key components for EC keys. The vulnerability only affects deployments using EC keys for JWT token signing, not RSA configurations. Fixed versions are uaa_release v78.13.0+ and CF Deployment v56.1.0+.