CVE-2026-19607 Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-19607

A flaw in the first-broker-login flow of the keycloak-services component in Red Hat build of Keycloak allows an attacker to register a matching username on an external identity provider, triggering a username collision that locks out the legitimate user. The root cause is insufficient validation ...

keycloak-services: keycloak-services: Broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

keycloak-services: keycloak-services: Broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-19607

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization in the update process of the UsersController due to assigning the activated field from the request payload before evaluating the authorization gate. ...

CVE-2026-86760 snipe-it 8.2.0 before 8.7.0 Authentication Bypass via activated flag

Snipe-IT versions 8.2.0 through 8.6.x fixed in 8.7.0 contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update. The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an...

CVE-2026-86760

Snipe-IT versions 8.2.0 through 8.6.x (fixed in 8.7.0 ) contain an incorrect authorization flaw in the single-user edit controller (UsersController::update). The activated field was assigned from the request payload before the canEditAuthFields authorization gate was evaluated. An authenticated n...

EUVD-2026-74937

Snipe-IT versions 8.2.0 through 8.6.x fixed in 8.7.0 contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update. The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an...

CVE-2026-86760: Incorrect Authorization

Snipe-IT versions 8.2.0 through 8.6.x fixed in 8.7.0 contain an incorrect authorization flaw in app/Http/Controllers/Users/UsersController::update. The single-user edit route assigned the activated field from the request payload before evaluating the canEditAuthFields authorization gate, so an...

CVE-2026-82269

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-82269

Gophish through 0.12.1 has a flaw in its API authentication middleware that fails to enforce account lockout and forced password change policies when a user authenticates with a valid API key. An attacker who already holds a valid API key can retain full API access even after the associated accou...

CVE-2026-82269 Gophish Account Lockout and Forced Password Change Bypassable via API Key

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

EUVD-2026-67800

Gophish through 0.12.1 fails to enforce account lockout and password change requirements in the API authentication middleware. Attackers with valid API keys can bypass these security controls and retain full API access even when their account is locked or password change is required...

CVE-2026-78617

WatchGuard Dimension's web login endpoint does not enforce effective rate-limiting or account lockout by default allowing a remote attacker to perform automated password guessing against user accounts. If the account lockout setting is enabled, brute-force attempts are blocked after a defined...

EUVD-2026-67285

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-76940

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...

CVE-2026-76940: Improper Restriction of Excessive Authentication Attempts

The affected Ebyte device does not restrict repeated authentication attempts through rate limiting or account lockout mechanisms. This could allow an attacker to perform automated authentication attacks against deployments that rely on password based authentication...