GHSA-FW7P-63QQ-7HPR vulnerabilities

Vulnerabilities for packages: kine, cerbos, croc, ratify, grafana-alloy, splunk-otel-collector, openfga, rekor, sftpgo, seaweedfs, sftpgo-plugin-eventstore, ksops, spire-server, certificate-transparency, apko, envoy-gateway, jitsucom-bulker, kyverno-policy-reporter, temporal, witness, tailscale,...

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider IdP is enabled before issuing tokens. The issuer lookup mechanism lookupIdentityProviderFromIssuer retrieves the IdP configuration but does not filter...

GHSA-37GF-GMXV-74WV Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider IdP is enabled before issuing tokens. The issuer lookup mechanism lookupIdentityProviderFromIssuer retrieves the IdP configuration but does not filter...

org.keycloak.protocol.oidc.grants: Disabled identity providers are still accepted for JWT Authorization Grant

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider IdP is enabled before issuing tokens. The issuer lookup mechanism lookupIdentityProviderFromIssuer retrieves the IdP configuration but does not filter...

CVE-2026-1486

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider IdP is enabled before issuing tokens. The issuer lookup mechanism lookupIdentityProviderFromIssuer retrieves the IdP configuration but does not filter...

CVE-2026-1486

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider IdP is enabled before issuing tokens. The issuer lookup mechanism lookupIdentityProviderFromIssuer retrieves the IdP configuration but does not filter...

CVE-2026-1486

CVE-2026-1486 : In Keycloak, the jwt-authorization-grant flow fails to verify whether an IdP is enabled before issuing tokens. The issuer lookup (lookupIdentityProviderFromIssuer) fetches the IdP config but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to com...

CVE-2026-1486 Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider IdP is enabled before issuing tokens. The issuer lookup mechanism lookupIdentityProviderFromIssuer retrieves the IdP configuration but does not filter...

Exploit for CVE-2026-23552

CVE-2026-23552 - Cross-Realm Token Acceptance in camel-keycloa...

PT-2026-7128

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the jwt-authorization-grant flow where the server does not verify if an Identity Provider IdP is enabled before issuing tokens. The lookupIdentityProviderFromIssuer mechanis...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator-fips, mariadb-operator, aws-privateca-issuer-fips, gitlab-operator-fips, cert-manager-google-cas-issuer-fips, mariadb-operator-fips, percona-server-mongodb-operator, cert-manager-csi-driver-fips, opentelemetry-operator-fips,...

CVE-2026-25518 vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, opentelemetry-operator, aws-privateca-issuer, cert-manager-webhook-pdns, cert-manager-csi-driver, mariadb-operator, cert-manager-istio-csr, cert-manager-cmctl, step-issuer...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator, opentelemetry-operator, aws-privateca-issuer, cert-manager-webhook-pdns, cert-manager-csi-driver, mariadb-operator, cert-manager-istio-csr, cert-manager-cmctl, step-issuer...

GHSA-GX3X-VQ4P-MHHV vulnerabilities

Vulnerabilities for packages: percona-server-mongodb-operator-fips, mariadb-operator, aws-privateca-issuer-fips, gitlab-operator-fips, cert-manager-google-cas-issuer-fips, mariadb-operator-fips, percona-server-mongodb-operator, cert-manager-csi-driver-fips, opentelemetry-operator-fips,...

CLEANSTART-2026-KV78041 processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

Multiple security vulnerabilities affect the step-issuer-fips package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. See references for individual vulnerability details...

CLEANSTART-2026-OL60454 Within HostnameError

Multiple security vulnerabilities affect the step-issuer package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-MI26039 Within HostnameError

Multiple security vulnerabilities affect the step-issuer package. Within HostnameError. See references for individual vulnerability details...

CLEANSTART-2026-KC01126 tar

Multiple security vulnerabilities affect the step-issuer package. tar. See references for individual vulnerability details...

GO-2026-4311 Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio

Fulcio is vulnerable to Server-Side Request Forgery SSRF via MetaIssuer Regex Bypass in github.com/sigstore/fulcio...

MiracleLinux 8 : openssl-1.1.1k-4.el8 (AXSA:2021-2623:05)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2021-2623:05 advisory. openssl: integer overflow in CipherUpdate CVE-2021-23840 openssl: NULL pointer dereference in X509issuerandserialhash CVE-2021-23841 Tenable has...