org.keycloak:keycloak-dependencies-server-all (1.9.8.final), org.keycloak:keycloak-dependencies-server-min (1.9.8.final) +2 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (1.9.8.final)

org.keycloak:keycloak-services MAVEN version 1.9.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.8.final -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.0.0-23.0, <=2.5.1-23.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.0.0-23.0, <=2.5.1-23.0) +28 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (23.0.1)

org.keycloak:keycloak-services MAVEN version 23.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.0.0-23.0, =2.0.0-23.0, =0.19, =0.16, =4.2,...

org.keycloak:keycloak-authz-policy-drools (6.0.0), org.keycloak:keycloak-dependencies-server-all (6.0.0) +8 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (6.0.0)

org.keycloak:keycloak-services MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 6.0.0 - org.keycloak:keycloak-dependencies-server-all 6.0...

de.adorsys.sts:keycloak-storage-provider (0.29.0), dk.grinn.keycloak:keycloak-migrate-resource (0.0.5) +10 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (5.0.0)

org.keycloak:keycloak-services MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider 0.29.0 - dk.grinn.keycloak:keycloak-migrate-resource 0.0.5...

org.keycloak:keycloak-authz-policy-drools (2.1.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.1.0.cr1) +3 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (2.1.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.1.0.cr1 -...

org.keycloak:keycloak-account-freemarker (1.8.0.cr3), org.keycloak:keycloak-broker-oidc (1.8.0.cr3) +9 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (1.8.0.cr3)

org.keycloak:keycloak-services MAVEN version 1.8.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.cr3 - org.keycloak:keycloak-broker-oidc 1.8.0.cr...

org.keycloak:keycloak-account-freemarker (1.0-beta-2), org.keycloak:keycloak-login-freemarker (1.0-beta-2) potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (1.0-beta-2)

org.keycloak:keycloak-services MAVEN version 1.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-2 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-account-freemarker (1.8.0.alpha1), org.keycloak:keycloak-broker-oidc (1.8.0.alpha1) +9 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (1.8.0.alpha1)

org.keycloak:keycloak-services MAVEN version 1.8.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.alpha1 - org.keycloak:keycloak-broker-oidc...

io.github.johnjcool:keycloak-cas-services (4.5.0.final), org.keycloak:keycloak-dependencies-server-min (4.5.0.final) +3 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (4.5.0.final)

org.keycloak:keycloak-services MAVEN version 4.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - io.github.johnjcool:keycloak-cas-services 4.5.0.final -...

org.keycloak:keycloak-dependencies-server-min (4.0.0.beta1), org.keycloak:keycloak-model-jpa (4.0.0.beta1) +2 more potentially affected by CVE-2026-1529 via org.keycloak:keycloak-services (4.0.0.beta1)

org.keycloak:keycloak-services MAVEN version 4.0.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.0.0.beta1 - org.keycloak:keycloak-model-jpa...

org.keycloak:keycloak-dependencies-server-min (4.8.0.final), org.keycloak:keycloak-model-jpa (4.8.0.final) +2 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (4.8.0.final)

org.keycloak:keycloak-services MAVEN version 4.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.8.0.final - org.keycloak:keycloak-model-jpa...

org.keycloak:keycloak-account-freemarker (1.6.0.final), org.keycloak:keycloak-broker-oidc (1.6.0.final) +9 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (1.6.0.final)

org.keycloak:keycloak-services MAVEN version 1.6.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.6.0.final - org.keycloak:keycloak-broker-oidc...

GHSA-FM6W-RRP3-2X4W Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService

A flaw was found in Keycloak. A significant Broken Access Control vulnerability exists in the UserManagedPermissionService UMA Protection API. When updating or deleting a UMA policy associated with multiple resources, the authorization check only verifies the caller's ownership against the first...

org.keycloak:keycloak-dependencies-server-all (1.9.0.final), org.keycloak:keycloak-dependencies-server-min (1.9.0.final) +2 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (1.9.0.final)

org.keycloak:keycloak-services MAVEN version 1.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.0.final -...

com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=11.0.2), fr.cnieg.keycloak:attribute-login-provider (>=1.1.0, <=1.2.4) +9 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (11.0.2)

org.keycloak:keycloak-services MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport =11.0.1, =1.1.0, =1.2.4 -...

com.charlyghislain.keycloak:keycloak-importexport (19.0.0), com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.7, <=1.4.8) +32 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (19.0.1)

org.keycloak:keycloak-services MAVEN version 19.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport 19.0.0 -...

org.keycloak:keycloak-account-freemarker (1.0-alpha-3), org.keycloak:keycloak-login-freemarker (1.0-alpha-3) +1 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (1.0-alpha-3)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-alpha-3 - org.keycloak:keycloak-login-freemarker...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.16), com.github.vzakharchenko:cisco-radius-plugin (1.3.16) +24 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (16.0.0)

org.keycloak:keycloak-services MAVEN version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.16 -...

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider IdP is enabled before issuing tokens. The issuer lookup mechanism lookupIdentityProviderFromIssuer retrieves the IdP configuration but does not filter...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=0.3.0-20.0.1, <=0.3.3-20.0.1), fr.cnieg.keycloak:attribute-login-provider (1.3.2) +25 more potentially affected by CVE-2026-1486 via org.keycloak:keycloak-services (20.0.1)

org.keycloak:keycloak-services MAVEN version 20.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =0.3.0-20.0.1, =0.6, =0.2, =0.2, =0.3, =0.11 -...