ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +147 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (>=26.0.0, <=26.5.1)

org.keycloak:keycloak-server-spi-private MAVEN version =26.0.0, =1.1.0, =1.0.1, =1.1.0, =0.0.0, =0.0.0, =0.0.0, =1.0.0, =2.0.0 and more Source cves: CVE-2026-0871 Source advisory: GHSA-V4JW-M6RM-399H...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.0, <=1.4.2), com.github.vzakharchenko:cisco-radius-plugin (>=1.4.0, <=1.4.2) +34 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (17.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 17.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.4.0, =1.4.0, =1.4.0,...

Access Control Bypass

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Access Control Bypass due to the DefaultAttributes attribute filtering in the user profile...

org.keycloak:keycloak-authz-policy-common (2.4.0.cr1), org.keycloak:keycloak-authz-policy-drools (2.4.0.cr1) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.4.0.cr1)

org.keycloak:keycloak-server-spi-private MAVEN version 2.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.4.0.cr1 -...

org.keycloak:keycloak-authz-policy-common (2.4.0.final), org.keycloak:keycloak-authz-policy-drools (2.4.0.final) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.4.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 2.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.4.0.final -...

org.keycloak:keycloak-authz-policy-common (2.5.1.final), org.keycloak:keycloak-authz-policy-drools (2.5.1.final) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.5.1.final)

org.keycloak:keycloak-server-spi-private MAVEN version 2.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.5.1.final -...

org.keycloak:keycloak-authz-policy-common (2.5.4.final), org.keycloak:keycloak-authz-policy-drools (2.5.4.final) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.5.4.final)

org.keycloak:keycloak-server-spi-private MAVEN version 2.5.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.5.4.final -...

org.keycloak:keycloak-authz-policy-common (3.0.0.cr1), org.keycloak:keycloak-authz-policy-drools (3.0.0.cr1) +11 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (3.0.0.cr1)

org.keycloak:keycloak-server-spi-private MAVEN version 3.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 3.0.0.cr1 -...

org.keycloak:keycloak-authz-policy-common (3.1.0.cr1), org.keycloak:keycloak-authz-policy-drools (3.1.0.cr1) +11 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (3.1.0.cr1)

org.keycloak:keycloak-server-spi-private MAVEN version 3.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 3.1.0.cr1 -...

org.keycloak:keycloak-authz-policy-common (2.5.0.cr1), org.keycloak:keycloak-authz-policy-drools (2.5.0.cr1) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.5.0.cr1)

org.keycloak:keycloak-server-spi-private MAVEN version 2.5.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.5.0.cr1 -...

org.keycloak:keycloak-authz-policy-common (2.5.0.final), org.keycloak:keycloak-authz-policy-drools (2.5.0.final) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.5.0.final)

org.keycloak:keycloak-server-spi-private MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.5.0.final -...

org.keycloak:keycloak-authz-policy-common (2.5.5.final), org.keycloak:keycloak-authz-policy-drools (2.5.5.final) +12 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (2.5.5.final)

org.keycloak:keycloak-server-spi-private MAVEN version 2.5.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - org.keycloak:keycloak-authz-policy-common 2.5.5.final -...

fr.cnieg.keycloak:attribute-login-provider (>=1.3.9, <=1.3.10), io.phasetwo.keycloak:keycloak-events (>=0.21, <=0.22) +41 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (22.0.5)

org.keycloak:keycloak-server-spi-private MAVEN version 22.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - fr.cnieg.keycloak:attribute-login-provider =1.3.9, =0.21, =0.44, =3.2.8.final,...

fr.cnieg.keycloak:attribute-login-provider (1.4.5), io.github.opentdf.keycloak:keycloak-opentdf-extension (1.1.0) +61 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (24.0.1)

org.keycloak:keycloak-server-spi-private MAVEN version 24.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.5 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.5.6-24.0, <=2.7.4-24.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0, <=2.7.4-24.0) +57 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (24.0.2)

org.keycloak:keycloak-server-spi-private MAVEN version 24.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.5.6-24.0, =2.5.6-24.0,...

de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak (2.3.2), de.fraunhofer.iosb.ilt.frost-server:frost-server.http (2.3.2) +68 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (24.0.4)

org.keycloak:keycloak-server-spi-private MAVEN version 24.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak 2.3.2 -...

fr.cnieg.keycloak:attribute-login-provider (1.4.11), io.phasetwo.keycloak:keycloak-events (>=0.30, <=0.33) +29 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (25.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - fr.cnieg.keycloak:attribute-login-provider 1.4.11 -...

de.adorsys.sts:keycloak-storage-provider (>=1.2.0, <=1.2.4), net.optionfactory.keycloak:optionfactory-keycloak-apple-identity-provider (>=6.5, <=6.9) +33 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (25.0.2)

org.keycloak:keycloak-server-spi-private MAVEN version 25.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.2.0, =6.5, =6.5, =6.5, =6.5, =6.5,...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (4.0.2-25.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (4.0.2-25.0) +33 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (25.0.4)

org.keycloak:keycloak-server-spi-private MAVEN version 25.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension 4.0.2-25.0 -...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +147 more potentially affected by CVE-2026-0871 via org.keycloak:keycloak-server-spi-private (>=26.0.0, <=26.5.1)

org.keycloak:keycloak-server-spi-private MAVEN version =26.0.0, =1.1.0, =1.0.1, =1.1.0, =0.0.0, =0.0.0, =0.0.0, =1.0.0, =2.0.0 and more Source cves: CVE-2026-0871 Source advisory: SNYK:JAVA-ORGKEYCLOAK-15366517...