CVE-2026-9800

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...

Cross-site Scripting (XSS)

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the client URI validation process. An attacker can execute arbitrary scripts in...

GHSA-RCQC-6CW3-H962 vulnerabilities

Vulnerabilities for packages: opensearch, geoserver, cassandra, pinot-fips, apache-hop, confluent-kafka, kafbat-ui-fips, nacos-docker, spdx-tools-java, thingsboard, confluent-kafka-jre-bcfips, dependency-track, ruby3.4-jrjackson, apache-camel-karavan-devmode, scala, request-9047-keycloak-fips,...

GHSA-J3RV-43J4-C7QM vulnerabilities

Vulnerabilities for packages: spdx-tools-java, ontop, nacos-docker, zipkin, management-api-for-apache-cassandra-4.0, localstack, wazuh-indexer, spark-kubernetes-operator, ruby3.2-jrjackson, nextflow, jmeter, conductor-fips, flyway, knative-kafka-broker, zookeeper, flyway-fips, gradle,...

CVE-2026-54512 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, ontop, nacos-docker, zipkin, management-api-for-apache-cassandra-4.0, localstack, wazuh-indexer, spark-kubernetes-operator, ruby3.2-jrjackson, nextflow, jmeter, conductor-fips, flyway, knative-kafka-broker, zookeeper, flyway-fips, gradle,...

CVE-2026-54514 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, ontop, nacos-docker, zipkin, management-api-for-apache-cassandra-4.0, localstack, wazuh-indexer, spark-kubernetes-operator, ruby3.2-jrjackson, nextflow, jmeter, conductor-fips, flyway, knative-kafka-broker, zookeeper, flyway-fips, gradle,...

CVE-2026-54517 vulnerabilities

Vulnerabilities for packages: opensearch, geoserver, cassandra, pinot-fips, apache-hop, confluent-kafka, kafbat-ui-fips, nacos-docker, spdx-tools-java, thingsboard, confluent-kafka-jre-bcfips, dependency-track, ruby3.4-jrjackson, apache-camel-karavan-devmode, scala, request-9047-keycloak-fips,...

CVE-2026-54513 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, ontop, nacos-docker, zipkin, management-api-for-apache-cassandra-4.0, localstack, wazuh-indexer, spark-kubernetes-operator, ruby3.2-jrjackson, nextflow, jmeter, conductor-fips, flyway, knative-kafka-broker, zookeeper, flyway-fips, gradle,...

CVE-2026-54516 vulnerabilities

Vulnerabilities for packages: opensearch, geoserver, cassandra, pinot-fips, apache-hop, confluent-kafka, kafbat-ui-fips, nacos-docker, spdx-tools-java, thingsboard, confluent-kafka-jre-bcfips, dependency-track, ruby3.4-jrjackson, apache-camel-karavan-devmode, scala, request-9047-keycloak-fips,...

GHSA-HGJ6-7826-R7M5 vulnerabilities

Vulnerabilities for packages: spdx-tools-java, ontop, nacos-docker, zipkin, management-api-for-apache-cassandra-4.0, localstack, wazuh-indexer, spark-kubernetes-operator, ruby3.2-jrjackson, nextflow, jmeter, conductor-fips, flyway, knative-kafka-broker, zookeeper, flyway-fips, gradle,...

GHSA-RMJ7-2VXQ-3G9F vulnerabilities

Vulnerabilities for packages: spdx-tools-java, ontop, nacos-docker, zipkin, management-api-for-apache-cassandra-4.0, localstack, wazuh-indexer, spark-kubernetes-operator, ruby3.2-jrjackson, nextflow, jmeter, conductor-fips, flyway, knative-kafka-broker, zookeeper, flyway-fips, gradle,...

GHSA-5HH8-Q8HV-FR38 vulnerabilities

Vulnerabilities for packages: opensearch, geoserver, cassandra, pinot-fips, apache-hop, confluent-kafka, kafbat-ui-fips, nacos-docker, spdx-tools-java, thingsboard, confluent-kafka-jre-bcfips, dependency-track, ruby3.4-jrjackson, apache-camel-karavan-devmode, scala, request-9047-keycloak-fips,...

CVE-2026-54518 vulnerabilities

Vulnerabilities for packages: opensearch, geoserver, cassandra, pinot-fips, apache-hop, confluent-kafka, kafbat-ui-fips, nacos-docker, spdx-tools-java, thingsboard, confluent-kafka-jre-bcfips, dependency-track, ruby3.4-jrjackson, apache-camel-karavan-devmode, scala, request-9047-keycloak-fips,...

GHSA-9FXM-VC8V-HJ55 vulnerabilities

Vulnerabilities for packages: opensearch, geoserver, cassandra, pinot-fips, apache-hop, confluent-kafka, kafbat-ui-fips, nacos-docker, spdx-tools-java, thingsboard, confluent-kafka-jre-bcfips, dependency-track, ruby3.4-jrjackson, apache-camel-karavan-devmode, scala, request-9047-keycloak-fips,...

PT-2026-52508

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the client registration service allows a remote attacker with a previously issued Registration Access Token RAT to re-enable a client that was explicitly disabled by an...

PT-2026-52507

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A missing authorization check in the GroupResource.addChild endpoint within the Admin REST API allows an authenticated user with limited administrative privileges to reparent any existing...

PT-2026-52510

Name of the Vulnerable Software and Affected Versions Keycloak Policy Enforcer affected versions not specified Description An issue exists that allows authenticated users to bypass authorization policies, including role, scope, and User-Managed Access UMA permission checks. An attacker can gain...

PT-2026-52505

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A realm administrator with the manage-realm role can probe arbitrary filesystem paths by submitting an arbitrary path as a keystore parameter during the creation of a key provider component...

PT-2026-52592

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A JWT algorithm confusion flaw exists in the JWT Authorization Grant flow. An attacker possessing valid client credentials can bypass signature verification by forging an assertion. This...

PT-2026-52506

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An issue exists where a remote attacker with administrative privileges, specifically those with manage-client permission or access to client registration endpoints, can bypass client Uniform...