6012 matches found
CVE-2026-79651 Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...
CVE-2026-79651
CVE-2026-79651 is an unauthenticated denial-of-service vulnerability in the keycloak-services component of Keycloak, specifically in its theme localization endpoints . The root cause is that the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-m...
EUVD-2026-80830
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...
CVE-2026-74909 Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...
CVE-2026-74909
CVE-2026-74909 is an incomplete fix for CVE-2026-15573 in Keycloak's policy enforcer (component: keycloak-services). The enforcer fails to correctly normalize URLs containing percent-encoded characters such as semicolons or directory-traversal segments, allowing an authenticated user to trick the...
CVE-2026-74909 Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...
EUVD-2026-80829
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...
CVE-2026-18212 Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit...
CVE-2026-18212
Keycloak 's SAML Redirect Binding implementation is affected by a native memory leak. The custom DEFLATE compression and decompression helpers fail to release native zlib memory after processing, so an unauthenticated attacker can send repeated malformed SAML requests to exhaust native memory and...
CVE-2026-18212 Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit...
EUVD-2026-80828
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit...
CVE-2026-92141
Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
CVE-2026-19607
A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...
CVE-2026-79651
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...
CVE-2026-74909
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...
CVE-2026-18212
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit...
CVE-2026-17526
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...
CVE-2026-92141
Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...
CVE-2026-92141
The Jenkins Keycloak Authentication Plugin version 2.4.1 and earlier is vulnerable to an open redirect flaw because it does not restrict the redirect URL following a successful login. This allows attackers to perform phishing attacks by directing users to a Jenkins URL that forwards them to a mal...