CVE-2026-47889 Spring Framework sameSite Attribute Dropped in JettyCoreServerHttpResponse

A WebFlux application running on the Jetty 12 Core reactive adapter serializes response cookies without the sameSite attribute. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19...

org.hawkular.accounts:hawkular-accounts-distribution (>=1.0.6, <=1.0.16.final), org.hawkular.agent:hawkular-agent-itest-dist (>=0.6.0.final, <=0.12.0.final) +35 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.3.1.final)

org.keycloak:keycloak-adapter-core MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.hawkular.accounts:hawkular-accounts-distribution =1.0.6, =0.6.0.final,...

org.keycloak:keycloak-installed-adapter (1.4.0.final), org.keycloak:keycloak-jaxrs-oauth-client (1.4.0.final) +32 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.4.0.final)

org.keycloak:keycloak-adapter-core MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed-adapter 1.4.0.final -...

org.keycloak:keycloak-installed-adapter (1.5.1.final), org.keycloak:keycloak-jaxrs-oauth-client (1.5.1.final) +30 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.5.1.final)

org.keycloak:keycloak-adapter-core MAVEN version 1.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed-adapter 1.5.1.final -...

org.hawkular.accounts:hawkular-accounts-secret-store (>=2.0.7.final, <=2.0.8.final), org.hawkular.accounts:hawkular-accounts-secret-store-api (>=2.0.7.final, <=2.0.8.final) +32 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.8.0.alpha1)

org.keycloak:keycloak-adapter-core MAVEN version 1.8.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.hawkular.accounts:hawkular-accounts-secret-store =2.0.7.final, =2.0.7.final,...

org.keycloak:keycloak-installed-adapter (1.9.5.final), org.keycloak:keycloak-jaxrs-oauth-client (1.9.5.final) +29 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.9.5.final)

org.keycloak:keycloak-adapter-core MAVEN version 1.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed-adapter 1.9.5.final -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.9.0), org.keycloak:keycloak-installed-adapter (2.1.0.final) +32 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (2.1.0.final)

org.keycloak:keycloak-adapter-core MAVEN version 2.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.9.0 -...

org.keycloak:keycloak-fuse-adapter-dist (3.1.0.cr1), org.keycloak:keycloak-installed-adapter (3.1.0.cr1) +37 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (3.1.0.cr1)

org.keycloak:keycloak-adapter-core MAVEN version 3.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-fuse-adapter-dist 3.1.0.cr1 -...

org.keycloak:keycloak-fuse-adapter-dist (3.2.0.cr1), org.keycloak:keycloak-installed-adapter (3.2.0.cr1) +35 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (3.2.0.cr1)

org.keycloak:keycloak-adapter-core MAVEN version 3.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-fuse-adapter-dist 3.2.0.cr1 -...

com.kumuluz.ee.security:kumuluzee-security-keycloak (>=1.0.0, <=1.0.1), org.keycloak:keycloak-fuse-adapter-dist (3.2.1.final) +37 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (3.2.1.final)

org.keycloak:keycloak-adapter-core MAVEN version 3.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.kumuluz.ee.security:kumuluzee-security-keycloak =1.0.0, =1.0.1 -...

org.jenkins-ci.plugins:keycloak (2.1.0), org.keycloak:keycloak-fuse-adapter-dist (3.4.0.final) +36 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (3.4.0.final)

org.keycloak:keycloak-adapter-core MAVEN version 3.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.jenkins-ci.plugins:keycloak 2.1.0 - org.keycloak:keycloak-fuse-adapter-dist...

org.keycloak:keycloak-installed-adapter (22.0.0), org.keycloak:keycloak-jakarta-servlet-filter-adapter (22.0.0) +18 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (22.0.0)

org.keycloak:keycloak-adapter-core MAVEN version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed-adapter 22.0.0 -...

io.quarkus:quarkus-keycloak-admin-client (>=3.2.8.final, <=3.6.1), io.quarkus:quarkus-keycloak-admin-client-deployment (>=3.2.8.final, <=3.6.1) +6 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (22.0.5)

org.keycloak:keycloak-adapter-core MAVEN version 22.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - io.quarkus:quarkus-keycloak-admin-client =3.2.8.final, =3.2.8.final, =3.2.8.final, =0.0.17...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (3.0.0), de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak (>=2.0.13, <=2.3.1) +26 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (23.0.6)

org.keycloak:keycloak-adapter-core MAVEN version 23.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 3.0.0 -...

org.keycloak:keycloak-installed-adapter (24.0.2), org.keycloak:keycloak-jakarta-servlet-filter-adapter (24.0.2) +17 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (24.0.2)

org.keycloak:keycloak-adapter-core MAVEN version 24.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed-adapter 24.0.2 -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.9.0), org.jboss.windup.web:test-authentication-client (>=4.0.0.beta1, <=4.0.1.final) +50 more potentially affected by CVE-2024-7318 via org.keycloak:keycloak-core (2.1.0.final)

org.keycloak:keycloak-core MAVEN version 2.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.9.0 -...

com.canoo.dolphin-platform:dolphin-platform-security-client (>=0.19.0, <=1.0.0.cr3), de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20) +68 more potentially affected by CVE-2024-7318 via org.keycloak:keycloak-core (3.1.0.final)

org.keycloak:keycloak-core MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.canoo.dolphin-platform:dolphin-platform-security-client =0.19.0, =1.3.0, =1.3.0, =2.2.3 -...

org.keycloak:keycloak-adapter-core (3.4.0.cr1), org.keycloak:keycloak-admin-client (3.4.0.cr1) +56 more potentially affected by CVE-2024-7318 via org.keycloak:keycloak-core (3.4.0.cr1)

org.keycloak:keycloak-core MAVEN version 3.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 3.4.0.cr1 - org.keycloak:keycloak-admin-client 3.4.0.cr1 -...

org.keycloak:keycloak-adapter-core (1.9.5.final), org.keycloak:keycloak-admin-client (1.9.5.final) +43 more potentially affected by CVE-2023-6841 via org.keycloak:keycloak-core (1.9.5.final)

org.keycloak:keycloak-core MAVEN version 1.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 1.9.5.final - org.keycloak:keycloak-admin-client 1.9.5.final -...

org.keycloak:keycloak-adapter-core (2.5.0.final), org.keycloak:keycloak-admin-client (2.5.0.final) +52 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (2.5.0.final)

org.keycloak:keycloak-core MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 2.5.0.final - org.keycloak:keycloak-admin-client 2.5.0.final -...