Authenticated session substitution via unchecked OIDC audience

OIDC authentication bypass in UAA 4.5.0 through 79.6.0 allows remote authenticated users to establish a shadow-account browser session with a supplied JWT. The external OIDC login callback accepts a UAA-issued access token or cross-client ID token as id_token for a self-referencing provider without binding its audience to that provider's relying-party client. Exploitation requires a valid UAA user JWT, browser login state, and a self-UAA OIDC configuration; session privileges are limited to the mapped shadow account's memberships.