com.github.vzakharchenko:chillispot-radius-plugin (1.4.4), com.github.vzakharchenko:cisco-radius-plugin (1.4.4) +34 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (18.0.0)

org.keycloak:keycloak-services MAVEN version 18.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.4 -...

org.keycloak:keycloak-account-freemarker (1.8.0.final), org.keycloak:keycloak-broker-oidc (1.8.0.final) +9 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (1.8.0.final)

org.keycloak:keycloak-services MAVEN version 1.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.final - org.keycloak:keycloak-broker-oidc...

fr.cnieg.keycloak:attribute-login-provider (1.4.2), io.phasetwo.keycloak:keycloak-orgs (>=0.53, <=0.57) +24 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (23.0.6)

org.keycloak:keycloak-services MAVEN version 23.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.2 - io.phasetwo.keycloak:keycloak-orgs =0.53, =0.57...

org.keycloak:keycloak-dependencies-server-min (4.7.0.final), org.keycloak:keycloak-model-jpa (4.7.0.final) +2 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (4.7.0.final)

org.keycloak:keycloak-services MAVEN version 4.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.7.0.final - org.keycloak:keycloak-model-jpa...

io.github.johnjcool:keycloak-cas-services (>=4.1.0.final, <=4.1.1.final), org.keycloak:keycloak-dependencies-server-min (4.1.0.final) +3 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (4.1.0.final)

org.keycloak:keycloak-services MAVEN version 4.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services =4.1.0.final, =4.1.1.final -...

de.adorsys.sts:keycloak-storage-provider (0.29.0), dk.grinn.keycloak:keycloak-migrate-resource (0.0.5) +10 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (5.0.0)

org.keycloak:keycloak-services MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider 0.29.0 - dk.grinn.keycloak:keycloak-migrate-resource 0.0.5...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.0.2, <=1.1.0-alpha.1), org.keycloak:keycloak-account-freemarker (1.0.4.final) +4 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (1.0.4.final)

org.keycloak:keycloak-services MAVEN version 1.0.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.0.2, =1.1.0-alpha.1 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.3), com.github.vzakharchenko:cisco-radius-plugin (1.3.3) +23 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (12.0.2)

org.keycloak:keycloak-services MAVEN version 12.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.3 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.15), com.github.vzakharchenko:cisco-radius-plugin (1.3.15) +24 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (15.1.0)

org.keycloak:keycloak-services MAVEN version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.15 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.2.6), com.github.vzakharchenko:cisco-radius-plugin (1.2.6) +18 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (11.0.0)

org.keycloak:keycloak-services MAVEN version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.2.6 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.1), org.keycloak:keycloak-account-freemarker (1.0-final) +4 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (1.0-final)

org.keycloak:keycloak-services MAVEN version 1.0-final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.1 -...

io.github.johnjcool:keycloak-cas-services (4.8.3.final), it.vige:school-keycloak-rooms (>=1.2.2, <=1.3.0) +4 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (4.8.3.final)

org.keycloak:keycloak-services MAVEN version 4.8.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.8.3.final - it.vige:school-keycloak-rooms =1.2.2,...

Keycloak: Unauthorized account takeover via WebAuthn token replay

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay ExecuteActionsActionToken tokens within Keycloak's WebAuthn Web Authentication flow. By intercepting an execute-actions email link, an attacker can register their own authenticator to a victim's...

org.keycloak:keycloak-authz-policy-drools (2.2.1.final), org.keycloak:keycloak-dependencies-server-all (2.2.1.final) +4 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (2.2.1.final)

org.keycloak:keycloak-services MAVEN version 2.2.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.2.1.final -...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.11), com.github.vzakharchenko:cisco-radius-plugin (1.4.11) +22 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (21.0.0)

org.keycloak:keycloak-services MAVEN version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.11 -...

com.charlyghislain.keycloak:keycloak-importexport (21.0.0), de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.10.1-21.0.1, <=0.10.8-21.0.1) +34 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (21.0.1)

org.keycloak:keycloak-services MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport 21.0.0 -...

org.keycloak:keycloak-dependencies-server-all (1.9.4.final), org.keycloak:keycloak-dependencies-server-min (1.9.4.final) +2 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (1.9.4.final)

org.keycloak:keycloak-services MAVEN version 1.9.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.4.final -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.16), com.github.vzakharchenko:cisco-radius-plugin (1.3.16) +24 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (16.0.0)

org.keycloak:keycloak-services MAVEN version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.16 -...

org.keycloak:keycloak-authz-policy-drools (2.5.5.final), org.keycloak:keycloak-dependencies-server-all (2.5.5.final) +5 more potentially affected by CVE-2026-37982 via org.keycloak:keycloak-services (2.5.5.final)

org.keycloak:keycloak-services MAVEN version 2.5.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.5.final -...