CVE-2026-105306

A flaw exists in the Dynamic Client Registration flow of the Keycloak identity and access management server. The registration process fails to filter security-sensitive client attributes during new client creation. An attacker possessing a valid Initial Access Token can register a client that byp...

EUVD-2026-92257

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105302 Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105302 Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105302

A flaw in the User Session Note mapper of the Keycloak identity and access management solution allows for the exposure of sensitive internal credentials. The mapper fails to validate if a requested session note contains federated access tokens from external identity providers. Consequently, a del...

CVE-2026-105306

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105301 Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker-controlled crl-dp/ocsp urls

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

CVE-2026-105301

A flaw exists in the X.509 client-certificate authenticator of Keycloak , an identity and access management solution. When configured to check certificate revocation via CRL Distribution Points or OCSP , the server may process a specially crafted certificate provided by an attacker. This causes K...

EUVD-2026-92255

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

CVE-2026-105301 Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker-controlled crl-dp/ocsp urls

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105301

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

My-Exploits

My-Exploits Vulnerability research I have done on four widely deployed platform services: Keycloak, Apache NiFi, HashiCorp Vault and HashiCorp Nomad. For each finding this repo carries the write-once artifacts I actually use, a Metasploit module where it made sense, a standalone Python proof of...

CVE-2026-105301: Server-Side Request Forgery (SSRF)

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

CVE-2026-1529-Keycloak-Exploit-Tool

このリポジトリには README がありません。...

CVE-2021-3754

CVE-2021-3754 이 저장소는 2021년 8월 21일에 본인이 발견하고 보고한 CVE-2021-3754의 취약점 세부 정보와 익스플로잇을 문서화합니다. 메트릭 CWE-20: 부적절한 입력 검증 CVSS: 5.3 중간 설명 Apache Keycloak 및 Redhat SSO에서 공격자가 기존 사용자의 이메일 ID와 동일한 사용자 이름으로 자신을 등록할 수 있는 결함이 발견되었습니다. 이는 사용자 이름이 이메일보다 먼저 평가되기 때문에 발생합니다. Keycloak은 이메일을 사용자 이름으로 사용할 수 있도록 허용하지만, 해...

KeySniper

KeySniper Autor: Mitsec — x.com/ynsmroztas CVE-2026-18963 — toma de control de cuenta Keycloak sin autenticación mediante el flujo de restablecimiento de credenciales. KeySniper es un escáner orientado a producción para programas de bug bounty dentro del alcance y evaluaciones autorizadas: salida...

CVE-2026-18963-keycloak

CVE-2026-18963-keycloak CVE-2026-18963 — Keycloakのreset-credentialsバイパス - アカウント乗っ取り...

CVE-2020-10770-keycloak-exploit-poc

Keycloak Blind SSRF POC これは、Lauritz Holtmann氏が発見し、彼のブログ記事で文書化したBlind SSRF CVE-2020-10770のテスト方法に関するステップバイステップの解説です。 彼はまた、テスト方法を簡単に説明しています。これは、より詳細な説明です。 すべての功績はLauritz氏に帰属します。 セットアップ ここではMac OSX上のDockerを使用します。 3つのシェルが必要です。1つはKeycloakインスタンスを実行するもの、1つはリスナー用、もう1つはcurlリクエスト用です。 防御側 バージョン です）。別のClient...

Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)

Keycloak 12.0.1 and below allows an attacker to force the server to request an unverified URL using the OIDC parameter requesturi. This allows an attacker to execute a server-side request forgery SSRF attack. id: CVE-2020-10770 info: name: Keycloak = 12.0.1 - requesturi Blind Server-Side Request...