Lucene search
+L

4611 matches found

RedhatCVE
RedhatCVE
added 4 hours ago4 views

CVE-2026-16102

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

8.1CVSS5.2AI score
SaveExploits0References3
CVE
CVE
added 4 hours ago7 views

CVE-2026-15573

Keycloak has a vulnerability in its Authorization Services where the PathMatcher does not normalize URIs before policy comparison. The issue allows an authenticated user to bypass intended restrictions by adding characters such as a trailing slash or matrix parameters to a URL, causing the system...

8.1CVSS5.5AI score
SaveExploits0References6
Cvelist
Cvelist
added 4 hours ago11 views

CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

8.1CVSS
SaveExploits0References6
Vulnrichment
Vulnrichment
added 4 hours ago3 views

CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

8.1CVSS5.5AI score
SaveExploits0References6
EUVD
EUVD
added 4 hours ago4 views

EUVD-2026-53381

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

8.1CVSS5.5AI score
SaveExploits0References6
RedhatCVE
RedhatCVE
added 4 hours ago3 views

CVE-2026-15573

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...

8.1CVSS5.5AI score
SaveExploits0References3
RedhatCVE
RedhatCVE
added 4 hours ago3 views

CVE-2026-15572

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

8.8CVSS5.5AI score
SaveExploits0References3
RedhatCVE
RedhatCVE
added 4 hours ago3 views

CVE-2026-16442

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

7.4CVSS5.1AI score
SaveExploits0References3
Cvelist
Cvelist
added 4 hours ago14 views

CVE-2026-16443 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

7.4CVSS
SaveExploits0References6
ATTACKERKB
ATTACKERKB
added 4 hours ago3 views

CVE-2026-16443

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

7.4CVSS5.4AI score
SaveExploits0References7
RedhatCVE
RedhatCVE
added 4 hours ago4 views

CVE-2026-16443

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

7.4CVSS5.1AI score
SaveExploits0References3
OSSF Malicious Packages
OSSF Malicious Packages
added 5 hours ago2 views

Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf The package presents itself as a Keycloak typed client but on require executes a binary dropper. index.js loads adapter.js, which reconstructs...

6.3AI score
SaveExploits0References1
Nuclei
Nuclei
added 15 hours ago149 views

KeyCloak - Information Exposure

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients like client secret without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this...

6.5CVSS6.5AI score0.17943EPSS
SaveExploits0References4
Nuclei
Nuclei
added 15 hours ago97 views

Keycloak - SAML Core Package Signature Validation Flaw

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...

7.7CVSS6.5AI score0.0203EPSS
SaveExploits0References5
Nuclei
Nuclei
added 15 hours ago290 views

Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting

Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response i...

6.1CVSS6.5AI score0.37246EPSS
SaveExploits3References6
Nuclei
Nuclei
added 15 hours ago116 views

Keycloak - Open Redirect

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...

6.1CVSS5.6AI score0.01959EPSS
SaveExploits0References2
Nuclei
Nuclei
added 15 hours ago163 views

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

8.1CVSS7.4AI score0.02862EPSS
SaveExploits0References5
Cvelist
Cvelist
added yesterday39 views

CVE-2026-18569 Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature...

3.7CVSS0.00162EPSS
SaveExploits0References2
CVE
CVE
added yesterday16 views

CVE-2026-18569

The vulnerability CVE-2026-18569 affects the Red Hat Build of Keycloak, specifically the keycloak-services component’s backchannel logout endpoint. The root cause is when an OIDC identity provider is configured to skip signature validation, causing the system to accept logout requests with no cry...

3.7CVSS5.5AI score0.00162EPSS
SaveExploits0References2
EUVD
EUVD
added yesterday8 views

EUVD-2026-52575

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature...

3.7CVSS5.5AI score0.00162EPSS
SaveExploits0References2
Rows per page
Query Builder