org.keycloak:keycloak-authz-policy-common (2.4.0.final), org.keycloak:keycloak-authz-policy-drools (2.4.0.final) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.4.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 2.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.4.0.final -...

org.keycloak:keycloak-authz-policy-common (2.5.1.final), org.keycloak:keycloak-authz-policy-drools (2.5.1.final) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.5.1.final)

org.keycloak:keycloak-server-spi-private MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.5.1.final -...

org.keycloak:keycloak-authz-policy-common (2.5.5.final), org.keycloak:keycloak-authz-policy-drools (2.5.5.final) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.5.5.final)

org.keycloak:keycloak-server-spi-private MAVEN version 2.5.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.5.5.final -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.12, <=1.3.14), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.12, <=1.3.14) +37 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (15.0.2)

org.keycloak:keycloak-server-spi-private MAVEN version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.12, =1.3.12, =1.3.12,...

CVE-2025-12150

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...

CVE-2026-0871

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the syste...

CVE-2025-12150 Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...

CVE-2025-12150 Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...

CVE-2025-12150

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...

CVE-2025-12150 Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...

CVE-2026-0871 Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the syste...

CVE-2026-0871

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the syste...

CVE-2026-0871

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the syste...

CVE-2026-0871 Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the syste...

CVE-2026-0871

CVE-2026-0871 concerns Keycloak where an administrator with the privileged role manage-users can bypass the system’s restriction “Only administrators can view” for unmanaged attributes, enabling edits to these attributes and resulting in unauthorized changes to user profiles. The issue is an impr...

CVE-2026-0871 Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

A flaw was found in Keycloak. An administrator with manage-users permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the syste...

PT-2026-22313

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak’s WebAuthn registration component. This allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators by submitting...

CVE-2025-12150: Improper Verification of Cryptographic Signature

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...

Keycloak 数据伪造问题漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a vulnerability related to data falsification. This vulnerability stems from defects in the WebAuthn registration component, which may allow for bypassing configured proofing policies and...

PT-2026-22311

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An issue exists in Keycloak where an administrator possessing manage-users permission can circumvent the intended restriction of the "Only administrators can view" setting for unmanaged...