Exploit for CVE-2026-18963

0day-Exploits Vulnerability research I have done on four wide...

Exploit for CVE-2026-18963

My-Exploits Vulnerability research I have done on four widely...

Keycloak -- multiple vulnerabilities

The Keycloak Team reports: CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname CVE-2026-16093: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers CVE-2026-16072: Organization...

CVE-2026-55857 vulnerabilities

Vulnerabilities for packages: metabase, request-9047-keycloak-fips, zipkin, reposilite, airbyte-platform, flyway-fips, flyway, airbyte-platform-fips, keycloak, camunda-zeebe, camunda, keycloak-fips, debezium...

GHSA-XVR9-35CR-46V9 vulnerabilities

Vulnerabilities for packages: metabase, request-9047-keycloak-fips, zipkin, reposilite, airbyte-platform, flyway-fips, flyway, airbyte-platform-fips, keycloak, camunda-zeebe, camunda, keycloak-fips, debezium...

CVE-2026-55856 vulnerabilities

Vulnerabilities for packages: metabase, request-9047-keycloak-fips, zipkin, reposilite, airbyte-platform, flyway-fips, flyway, airbyte-platform-fips, keycloak, camunda-zeebe, camunda, keycloak-fips, debezium...

GHSA-G9JJ-CGMH-9F38 vulnerabilities

Vulnerabilities for packages: metabase, request-9047-keycloak-fips, zipkin, reposilite, airbyte-platform, flyway-fips, flyway, airbyte-platform-fips, keycloak, camunda-zeebe, camunda, keycloak-fips, debezium...

CVE-2026-55858 vulnerabilities

Vulnerabilities for packages: metabase, request-9047-keycloak-fips, zipkin, reposilite, airbyte-platform, flyway-fips, flyway, airbyte-platform-fips, keycloak, camunda-zeebe, camunda, keycloak-fips, debezium...

GHSA-QXVW-FVWX-5CP7 vulnerabilities

Vulnerabilities for packages: metabase, request-9047-keycloak-fips, zipkin, reposilite, airbyte-platform, flyway-fips, flyway, airbyte-platform-fips, keycloak, camunda-zeebe, camunda, keycloak-fips, debezium...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature when extracting Keycloak realm and client roles due to missing verification of access token signatures, issuers, audiences, or expiry. An attacker can gain unauthorized privileges by...

CVE-2026-82461

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

EUVD-2026-68118

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82461

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82461

pac4j-oidc versions before 6.5.6 fail to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles via the KeycloakRolesAuthorizationGenerator component. Attackers with low privileges can forge access tokens containing administrative roles paire...

Authentication Bypass

Red Hat Build of Keycloak keycloak-services is vulnerable to an authentication bypass. The vulnerability is due to improper validation in the reset-credentials flow, which allows an unauthenticated attacker to bypass the required email verification step and directly set new credentials...

CVE-2026-82461: Improper Verification of Cryptographic Signature

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

PT-2026-83441

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...