CVE-2026-108718

The Rill platform (versions 0.77.0 through 0.90.5 ) contains a missing authorization vulnerability within the admin OAuth server . The flaw allows the server to issue authorization codes to dynamically registered clients without requiring explicit user consent. An attacker can register a maliciou...

CVE-2026-107623

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

EUVD-2026-95034

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623 Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623

A flaw exists in the OIDC Dynamic Client Registration (DCR) component of Keycloak . A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

CVE-2026-107623

A flaw was found in the OIDC Dynamic Client Registration DCR component of Keycloak. A bug in the response serialization causes the backchannel logout offline token revocation setting to be omitted from responses. When a client performs a standard update, this missing information causes the settin...

Keycloak 26.4.0 <= 26.8.0 Token Introspection Audience Bypass (CVE-2026-105306)

The version of Keycloak installed on the remote host is 26.4.0 through 26.8.0. It is, therefore, affected by a token introspection audience bypass vulnerability. An attacker able to use dynamic client registration can register a client that passes token introspection for tokens that were not issu...

CVE-2026-105306

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105306 Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105306 Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

EUVD-2026-92258

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105306

A flaw exists in the Dynamic Client Registration flow of the Keycloak identity and access management server. The registration process fails to filter security-sensitive client attributes during new client creation. An attacker possessing a valid Initial Access Token can register a client that byp...

CVE-2026-105306

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105306: Missing Authorization

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

PT-2026-104728

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Dynamic Client Registration flow of the Keycloak identity and access management server. The registration process fails to filter security-sensitive client attributes...

GO-2026-6530 Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot

Obot: OAuth Dynamic Client Registration Enables API Token Theft via Audience Confusion in github.com/obot-platform/obot...

CVE-2026-101062

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...

CVE-2026-101062

Obot versions prior to v0.23.0 (specifically

CVE-2026-101062 Obot before v0.23.0 Authentication Bypass via OAuth Dynamic Client Registration

Obot before v0.23.0 affected versions = v0.22.1 running with OBOTSERVERENABLEAUTHENTICATION=true exposes OAuth dynamic client registration without authentication and without any restriction on the redirect URIs a client may register. Because the authorization flow auto-completes for an already...