Origin Validation Error

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Origin Validation Error via the review profile process. An attacker can gain unauthorized access to...

CVE-2025-7365

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

CVE-2025-7365 Keycloak: phishing attack via email verification step in first login flow

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

CVE-2025-7365 Keycloak: phishing attack via email verification step in first login flow

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

CVE-2025-7365

Keycloak vulnerability CVE-2025-7365 involves an IdP login flow where an authenticated attacker merging accounts can alter their email to match a victim’s, triggering a verification email to the victim. If the victim clicks the verification link, the attacker could gain access to the victim’s acc...

CVE-2025-7365 Keycloak: phishing attack via email verification step in first login flow

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

Keycloak 访问控制错误漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an access control error vulnerability that stems from a flaw in the account merge function during identity provider login, which could allow an attacker to gain access to a victim's...

PT-2025-29098

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw exists in Keycloak that allows an authenticated attacker to potentially gain access to a victim's account. During an identity provider IdP login, if an attacker attempts to merge...

Server with Rockerbox Tax Firm Data Exposed 286GB of Records

Cybersecurity researcher Jeremiah Fowler uncovered a massive 286GB data exposure at Texas-based Rockerbox, a tax credit consultancy. Exposed data includes SSNs, DD214s, and financial details, raising serious identity theft and fraud concerns...

Security Bulletin: Security vulnerabilities have been addressed in IBM Verify Identity Access OIDC Provider (CVE-2024-45337, CVE-2025-22869)

Summary Multiple security vulnerabilities have been addressed in IBM Verify Identity Access OIDC Provider. Vulnerability Details CVEID:CVE-2024-45337 DESCRIPTION: Applications and libraries which misuse connection.serverAuthenticate via callback field ServerConfig.PublicKeyCallback may be...

CVE-2025-4606

The CVE-2025-4606 entry concerns the Sala - Startup & SaaS WordPress Theme and its vulnerability to unauthenticated privilege escalation. Affected versions are all up to 1.1.4, where the theme fails to properly validate a user’s identity before updating details such as passwords. This allows an u...

PT-2025-28838 · Unknown · Sala - Startup & Saas Wordpress Theme

Name of the Vulnerable Software and Affected Versions: Sala - Startup & SaaS WordPress Theme versions prior to 1.1.5 Description: The issue arises from the theme's failure to properly validate a user's identity before updating their details, such as the password. This allows unauthenticated...

The vulnerability of the application software interface of the Cisco Identity Services Engine (ISE) and the Cisco ISE Passive Identity Connector (ISE-PIC), which is used for collecting user authentication data, allows a perpetrator to load arbitrary files.

The vulnerability of the application software interface of the Cisco Identity Services Engine ISE and the Cisco ISE Passive Identity Connector ISE-PIC, which acts as a virtual authentication data collection device, is related to deficiencies in access control. Exploiting this vulnerability could...

The vulnerability of the Cisco Identity Services Engine (ISE) platform, a control plane for network policies, stems from insufficient validation of input data. This allows attackers to execute arbitrary code.

The vulnerability of the Cisco Identity Services Engine ISE platform-related network policy management platform is related to insufficient validation of input data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

CVE-2025-7365

A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...

Infostealers-as-a-Service Push Identity Hacks to Record Highs

Identity-based cyberattacks soar 156%, driven by cheap Phishing-as-a-Service & infostealer malware. Learn how criminals bypass MFA to steal credentials, access bank accounts, and compromise business emails...

5 Ways Identity-based Attacks Are Breaching Retail

From overprivileged admin roles to long-forgotten vendor tokens, these attackers are slipping through the cracks of trust and access. Here's how five retail breaches unfolded, and what they reveal about... In recent months, major retailers like Adidas, The North Face, Dior, Victoria's Secret,...

Detection of Intelligent Tampering in Wireless Electrocardiogram Signals Using Hybrid Machine Learning

With the proliferation of wireless electrocardiogram ECG systems for health monitoring and authentication, protecting signal integrity against tampering is becoming increasingly important. This paper analyzes the performance of CNN, ResNet, and hybrid Transformer-CNN models for tamper detection. ...

Exploit for Injection in Cisco Identity_Services_Engine

CVE-2025-20281 — Cisco ISE Critical RCE Vulnerability 🛑...

Wallets As Universal Access Devices

Wallets are access points for the digital economys value creation. Wallets for blockchains store the end-users cryptographic keys for administrating their digital assets and enable access to blockchain Web3 systems. Web3 delivers new service opportunities. This chapter focuses on the Web3 enabled...