PT-2026-33603

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.7.0 Description The Keycloak authentication manager fails to generate or validate the OAuth 2.0 state parameter during the login and login-callback flow and does not implement PKCE Proof Ke...

Apache Airflow 安全漏洞

Apache Airflow is an open-source platform developed by the Apache Foundation in the United States. It allows for the creation, management, and monitoring of workflows. This platform features scalability and dynamic monitoring capabilities. However, Apache Airflow has security vulnerabilities. The...

CVE-2026-4282 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-F2HX-5FX3-HMCV vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-H4WV-G838-66G3 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-RX66-HJ7G-28H7 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-4633 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-4325 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-4636 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-3872 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-CJM2-J6CM-6P6M vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-4634 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-HJ93-H7PG-FH6V vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-RHGQ-F8X5-J2JC vulnerabilities

Vulnerabilities for packages: keycloak...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ResourceService in the resource management API. An...

CLEANSTART-2026-FA60324 It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session

Multiple security vulnerabilities affect the keycloak package. It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. See references for individual vulnerability details...

CLEANSTART-2026-QI14017 Vert

Multiple security vulnerabilities affect the keycloak package. The Vert. See references for individual vulnerability details...

Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting XSS vulnerability. This flaw occurs because the organization.alias is placed into an...

EUVD-2026-22294

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting XSS vulnerability. This flaw occurs because the organization.alias is placed into an...

GHSA-M32F-8VH9-2HH3 Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting XSS vulnerability. This flaw occurs because the organization.alias is placed into an...