Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to Server-side Request Forgery CVE-2026-1180

Summary keycloak is used by the IBM Datapower Operations Dashboard as part of their IAM and SSO implementation Vulnerability Details CVEID:CVE-2026-1180 DESCRIPTION: A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjw...

edu.byu.hbll.maven:application-parent (>=3.0.0, <=3.4.0), org.keycloak:keycloak-as7-adapter-dist (4.8.2.final) +46 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (4.8.2.final)

org.keycloak:keycloak-adapter-core MAVEN version 4.8.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - edu.byu.hbll.maven:application-parent =3.0.0, =3.4.0 -...

io.quarkus:quarkus-keycloak-admin-client (>=1.5.0.cr1, <=1.5.0.final), io.quarkus:quarkus-keycloak-admin-client-deployment (>=1.5.0.cr1, <=1.5.0.final) +38 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (10.0.0)

org.keycloak:keycloak-adapter-core MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - io.quarkus:quarkus-keycloak-admin-client =1.5.0.cr1, =1.5.0.cr1, =1.5.0.cr1, =1.5.0.cr1,...

com.jalalkiswani:jk-app-service (>=7.0.0-m3, <=7.0.0-m7), com.jalalkiswani:jk-app-web (>=7.0.0-m2, <=7.0.0-m7) +30 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (20.0.1)

org.keycloak:keycloak-adapter-core MAVEN version 20.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.jalalkiswani:jk-app-service =7.0.0-m3, =7.0.0-m2, =7.0.0-m2, =7.0.0-m3, =7.0.0-m3,...

com.github.vzakharchenko:keycloak-plugins (1.2.3), com.github.vzakharchenko:mikrotik-radius-plugin (1.2.3) +49 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (9.0.3)

org.keycloak:keycloak-adapter-core MAVEN version 9.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.2.3 -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.2.9, <=1.3.0), com.github.vzakharchenko:cisco-radius-plugin (>=1.2.9, <=1.3.0) +55 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (12.0.0)

org.keycloak:keycloak-adapter-core MAVEN version 12.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.10), com.github.vzakharchenko:cisco-radius-plugin (1.3.10) +56 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (15.0.0)

org.keycloak:keycloak-adapter-core MAVEN version 15.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.10 -...

org.keycloak:keycloak-installed (1.0-beta-1-20150521), org.keycloak:keycloak-jboss-adapter-core (1.0-beta-1-20150521) +4 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-beta-1-20150521)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-beta-1-20150521 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed 1.0-beta-1-20150521 -...

org.keycloak.secretstore:secret-store (1.0.13.final), org.keycloak.secretstore:secret-store-api (1.0.13.final) +31 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.8.1.final)

org.keycloak:keycloak-adapter-core MAVEN version 1.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak.secretstore:secret-store 1.0.13.final -...

org.keycloak:keycloak-installed-adapter (24.0.1), org.keycloak:keycloak-jakarta-servlet-filter-adapter (24.0.1) +17 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (24.0.1)

org.keycloak:keycloak-adapter-core MAVEN version 24.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed-adapter 24.0.1 -...

com.abavilla:fpi-bot-api (>=1.0.2, <=1.1.0), com.abavilla:fpi-bot-api-core (>=1.0.2, <=1.1.0) +102 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (18.0.2)

org.keycloak:keycloak-adapter-core MAVEN version 18.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.abavilla:fpi-bot-api =1.0.2, =1.0.2, =1.0.2, =1.0.132, =v1.3.1, =v1.3.1, =1.0.42,...

com.abavilla:fpi-bot-api (>=1.2.0, <=1.5.0), com.abavilla:fpi-bot-api-core (>=1.2.0, <=1.3.1) +63 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (19.0.3)

org.keycloak:keycloak-adapter-core MAVEN version 19.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.abavilla:fpi-bot-api =1.2.0, =1.2.0, =1.2.0, =1.3.2, =1.5.0, =1.5.0, =1.2.1, =1.2.1,...

org.keycloak:keycloak-appliance-dist-all (1.0-final), org.keycloak:keycloak-as7-adapter-dist (1.0-final) +8 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-final)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-appliance-dist-all 1.0-final -...

org.jenkins-ci.plugins:keycloak (2.0.3), org.keycloak:keycloak-fuse-adapter-dist (3.2.0.final) +37 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (3.2.0.final)

org.keycloak:keycloak-adapter-core MAVEN version 3.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.jenkins-ci.plugins:keycloak 2.0.3 - org.keycloak:keycloak-fuse-adapter-dist...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.5), com.github.vzakharchenko:cisco-radius-plugin (1.4.5) +55 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (18.0.1)

org.keycloak:keycloak-adapter-core MAVEN version 18.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.5 -...

com.c4-soft.springaddons:spring-security-oauth2-test-addons (>=2.0.0, <=2.0.3), com.c4-soft.springaddons:spring-security-oauth2-test-webflux-addons (>=2.0.0, <=2.0.3) +46 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (9.0.0)

org.keycloak:keycloak-adapter-core MAVEN version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.c4-soft.springaddons:spring-security-oauth2-test-addons =2.0.0, =2.0.0, =2.0.0, =1.1.0,...

de.retest:recheck (>=1.2.0-beta.1, <=1.4.0), de.retest:recheck-web (>=1.3.0-beta.1, <=1.4.0) +49 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (6.0.1)

org.keycloak:keycloak-adapter-core MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - de.retest:recheck =1.2.0-beta.1, =1.3.0-beta.1, =1.0.6, =0.16.0, =0.16.0, =2.4.0, =2.5.0 -...

org.keycloak:keycloak-jboss-adapter-core (1.0-alpha-4), org.keycloak:keycloak-servlet-oauth-client (1.0-alpha-4) +2 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-alpha-4)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-alpha-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-jboss-adapter-core 1.0-alpha-4 -...

org.eclipse.dirigible:dirigible-application (>=8.16.0, <=8.17.1), org.eclipse.dirigible:dirigible-components-security-keycloak (>=8.16.0, <=8.17.1) +26 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (22.0.4)

org.keycloak:keycloak-adapter-core MAVEN version 22.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.eclipse.dirigible:dirigible-application =8.16.0, =8.16.0, =8.17.1 -...

org.hawkular.accounts:hawkular-accounts-distribution (>=1.0.17.final, <=1.1.4.final), org.hawkular.accounts:hawkular-accounts-integration-tests-all-others (>=1.0.18.final, <=1.1.4.final) +35 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.6.0.final)

org.keycloak:keycloak-adapter-core MAVEN version 1.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.hawkular.accounts:hawkular-accounts-distribution =1.0.17.final, =1.0.18.final,...