de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.0.0-23.0, <=2.5.1-23.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.0.0-23.0, <=2.5.1-23.0) +28 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-services (23.0.1)

org.keycloak:keycloak-services MAVEN version 23.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.0.0-23.0, =2.0.0-23.0, =0.19, =0.16, =4.2,...

org.keycloak:keycloak-authz-policy-drools (3.3.0.final), org.keycloak:keycloak-dependencies-server-all (3.3.0.final) +6 more potentially affected by CVE-2026-9793 via org.keycloak:keycloak-services (3.3.0.final)

org.keycloak:keycloak-services MAVEN version 3.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.3.0.final -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.5.3-23.0, <=2.5.5-23.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.3-23.0, <=2.5.5-23.0) +66 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-server-spi-private (23.0.7)

org.keycloak:keycloak-server-spi-private MAVEN version 23.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.5.3-23.0, =2.5.3-23.0,...

fr.cnieg.keycloak:attribute-login-provider (1.4.4), io.phasetwo.keycloak:keycloak-events (>=0.27, <=0.28) +18 more potentially affected by CVE-2026-9792 via org.keycloak:keycloak-services (24.0.0)

org.keycloak:keycloak-services MAVEN version 24.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.4 - io.phasetwo.keycloak:keycloak-events =0.27,...

io.github.johnjcool:keycloak-cas-services (4.8.3.final), it.vige:school-keycloak-rooms (>=1.2.2, <=1.3.0) +11 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-server-spi-private (4.8.3.final)

org.keycloak:keycloak-server-spi-private MAVEN version 4.8.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.8.3.final -...

org.keycloak:keycloak-account-freemarker (1.8.0.cr1), org.keycloak:keycloak-broker-oidc (1.8.0.cr1) +9 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-services (1.8.0.cr1)

org.keycloak:keycloak-services MAVEN version 1.8.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.cr1 - org.keycloak:keycloak-broker-oidc 1.8.0.cr...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.3), org.keycloak:keycloak-account-freemarker (1.0.5.final) +4 more potentially affected by CVE-2026-9792 via org.keycloak:keycloak-services (1.0.5.final)

org.keycloak:keycloak-services MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.3 -...

org.keycloak:keycloak-dependencies-server-min (4.0.0.beta1), org.keycloak:keycloak-model-jpa (4.0.0.beta1) +2 more potentially affected by CVE-2026-9793 via org.keycloak:keycloak-services (4.0.0.beta1)

org.keycloak:keycloak-services MAVEN version 4.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.0.0.beta1 - org.keycloak:keycloak-model-jpa...

org.fintrace:keycloak-event-receiver-common (0.0.1), org.fintrace:keycloak-event-receiver-http (0.0.1) +11 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-server-spi-private (4.0.0.beta1)

org.keycloak:keycloak-server-spi-private MAVEN version 4.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.fintrace:keycloak-event-receiver-common 0.0.1 -...

org.keycloak:keycloak-authz-policy-drools (8.0.0), org.keycloak:keycloak-dependencies-server-all (8.0.0) +7 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-services (8.0.0)

org.keycloak:keycloak-services MAVEN version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 8.0.0 - org.keycloak:keycloak-dependencies-server-all 8.0...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=4.0.3-25.0, <=4.0.5-25.0) +23 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-services (25.0.6)

org.keycloak:keycloak-services MAVEN version 25.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - ch.iterial.keycloak.plugins:keycloak-directus-plugin =0.1.0, =4.0.3-25.0, =4.0.3-25.0, =4.0.5-25.0...

org.keycloak:keycloak-account-freemarker (1.0-alpha-3), org.keycloak:keycloak-login-freemarker (1.0-alpha-3) +1 more potentially affected by CVE-2026-9793 via org.keycloak:keycloak-services (1.0-alpha-3)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-3 - org.keycloak:keycloak-login-freemarker...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.0, <=1.4.2), com.github.vzakharchenko:cisco-radius-plugin (>=1.4.0, <=1.4.2) +34 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-server-spi-private (17.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 17.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.4.0, =1.4.0, =1.4.0,...

org.keycloak:keycloak-account-freemarker (1.5.0.final), org.keycloak:keycloak-broker-oidc (1.5.0.final) +8 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-services (1.5.0.final)

org.keycloak:keycloak-services MAVEN version 1.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.5.0.final - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-authz-policy-drools (2.5.0.final), org.keycloak:keycloak-dependencies-server-all (2.5.0.final) +5 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-services (2.5.0.final)

org.keycloak:keycloak-services MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.0.final -...

Keycloak has an Improper Verification of Cryptographic Signature issue

A flaw was found in Keycloak. When a JSON Web Encryption JWE encrypted request object is submitted, Keycloak may incorrectly process unsigned claims if the decrypted content is raw JSON, bypassing the configured signature policy. This allows a remote attacker to submit unauthorized claims, leadin...

org.keycloak:keycloak-authz-policy-drools (2.4.0.final), org.keycloak:keycloak-dependencies-server-all (2.4.0.final) +5 more potentially affected by CVE-2026-9792 via org.keycloak:keycloak-services (2.4.0.final)

org.keycloak:keycloak-services MAVEN version 2.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.4.0.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.1), org.keycloak:keycloak-account-freemarker (1.0-final) +4 more potentially affected by CVE-2026-9792 via org.keycloak:keycloak-services (1.0-final)

org.keycloak:keycloak-services MAVEN version 1.0-final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.0.2, <=1.1.0-alpha.1), org.keycloak:keycloak-account-freemarker (1.0.4.final) +4 more potentially affected by CVE-2026-9792 via org.keycloak:keycloak-services (1.0.4.final)

org.keycloak:keycloak-services MAVEN version 1.0.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.0.2, =1.1.0-alpha.1 -...

org.keycloak:keycloak-authz-policy-drools (3.4.0.cr1), org.keycloak:keycloak-dependencies-server-all (3.4.0.cr1) +6 more potentially affected by CVE-2026-9793 via org.keycloak:keycloak-services (3.4.0.cr1)

org.keycloak:keycloak-services MAVEN version 3.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.4.0.cr1 -...