PT-2026-22313

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak’s WebAuthn registration component. This allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators by submitting...

Keycloak 安全漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability, which stems from improper access control. This vulnerability could allow administrators with the manage-users permission to bypass settings and modify unmanaged...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: xeol, zarf, crossplane-provider-azure-sql, boring-registry, kyverno-notation-aws, crossplane-provider-aws-sqs, flux-source-controller, docker-cli-buildx, flux-image-automation-controller, trivy-operator, crossplane-provider-aws-route53, osv-scanner,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: xeol, zarf, crossplane-provider-azure-sql, boring-registry, kyverno-notation-aws, crossplane-provider-aws-sqs, flux-source-controller, docker-cli-buildx, flux-image-automation-controller, trivy-operator, crossplane-provider-aws-route53, osv-scanner,...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: databricks-cli, cluster-api-fips, nfpm, actions-runner-controller-fips, policy-controller, gomplate-fips, crossplane-provider-aws-lambda-fips, crossplane-provider-aws-eks, flux-image-automation-controller, terraform-provider-pagerduty, crossplane-provider-aws-dynamod...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: databricks-cli, cluster-api-fips, nfpm, actions-runner-controller-fips, policy-controller, gomplate-fips, crossplane-provider-aws-lambda-fips, crossplane-provider-aws-eks, flux-image-automation-controller, terraform-provider-pagerduty, crossplane-provider-aws-dynamod...

Apache Camel 4.15.0 < 4.18.0 Authentication Bypass (CVE-2026-23552)

The version of Apache Camel on the remote host is 4.15.0 prior to 4.18.0. It is, therefore, affected by an authentication bypass vulnerability: - The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one...

com.inventage.keycloak.role-based-timeout:keycloak-role-based-timeout (>=1.0.0, <=1.2.0), com.inventage.keycloak.sms-authenticator:keycloak-sms-authenticator (>=1.2.0, <=1.8.1) +71 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-services (>=26.5.0, <=26.5.5)

org.keycloak:keycloak-services MAVEN version =26.5.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.11.17, =1.1.2, =0.1.1-rc1, =26.1.2-kc26.4.4, =0.6.2, =0.7.5 - io.phasetwo.keycloak:keycloak-account-v1 0.11 and more Source cves: CVE-2026-3190 Source advisory:...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +101 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-services (>=26.0.0, <=26.4.7)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =1.1.1-26.0, =0.1.0, =1.4.0 and more Source cves: CVE-2026-3190 Source advisory: SNYK:JAVA-ORGKEYCLOAK-15426466...

Improper Handling of Insufficient Permissions or Privileges

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via improper enforcement of roles in the UMA 2.0...

CVE-2026-23552

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

Incorrect Privilege Assignment

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the manage-clients permission assignment. An attacker can gain unauthorize...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +208 more potentially affected by CVE-2026-3121 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.5.5)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =1.4.11 - com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak 24.3.0.0 and more Source cves: CVE-2026-3121 Source advisory:...

GHSA-C3F3-CC42-XR9V Apache Camel: KeycloakSecurityPolicy does not validate issuer of JWT tokens against configured realm

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the KeycloakSecurityPolicy which does not validate the iss issuer claim of JWT tokens against the configured realm. An attacker can gain unauthorized access to resources by providing a JWT token issued by a...

CVE-2026-23552

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

CVE-2026-23552 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

CVE-2026-23552 Apache Camel: Camel-Keycloak: Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

CVE-2026-23552

Cross-Realm Token Acceptance Bypass in KeycloakSecurityPolicy Apache Camel Keycloak component. The Camel-Keycloak KeycloakSecurityPolicy does not validate the iss issuer claim of JWT tokens against the configured realm. A token issued by one Keycloak realm is silently accepted by a policy...

CVE-2026-23552

Apache Camel versions 4.15.0 through 4.17.0 are vulnerable to a Cross-Realm Token Acceptance Bypass in the KeycloakSecurityPolicy component. The root cause is that the component fails to validate the iss (issuer) claim of JWT tokens against the configured realm. When no public key is explicitly p...