4783 matches found
BIT-KEYCLOAK-2024-7318 Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity
A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds default. Instead of expiring and deemed unusable around 30 seconds in, the tokens are valid for an additional 30 seconds totaling 1 minute. A one time passco...
BIT-KEYCLOAK-2024-7260 Keycloak-core: open redirect on account page
An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referreruri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it...
CVE-2026-79652
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
CVE-2026-79652 Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
EUVD-2026-65465
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
CVE-2026-79652
A flaw in the JWT Bearer authorization grant within the keycloak-services component of Red Hat Build of Keycloak fails to verify whether a client requires user consent before issuing an access token. An authenticated attacker with valid client credentials and a trusted identity provider assertion...
CVE-2026-79652
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
BIT-KEYCLOAK-2026-18963 Flaw in the reset-credentials flow of the keycloak-services component
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
BIT-KEYCLOAK-2026-15571 Flaw in the legacy client-initiated account-linking endpoint of Keycloak
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC...
CVE-2021-20323
CVE-2021-20323 Scanner di exploit per la vulnerabilità Cross Site Scripting in Keycloak...
CVE-2026-18963_analyst
Laboratorio Docker Keycloak CVE-2026-18963 Questo laboratorio avvia la versione vulnerabile di Keycloak 26.7.1 su localhost e inizializza un realm minimale per riprodurre il flusso della CVE. Documenti di indagine Analisi del flusso di lavoro: causa root a livello di sorgente, sequenza delle...
Exploit for CVE-2026-18963
CVE-2026-18963 — Lab tái dựng lại Keycloak reset-credentials...
VulnCheck KEV: CVE-2026-18963
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
Exploit for CVE-2026-18963
CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account T...
keycloak-cve-2026-18963-hunt
CVE-2026-18963: Keycloak account takeover, caccia alle tracce di sfruttamento Uno script psql che cerca in un database PostgreSQL di Keycloak le tracce dello sfruttamento di CVE-2026-18963 account takeover non autenticato tramite il flusso reset-credentials. Pubblicato da KYOS. Lo abbiamo scritto...
CVE-2025-68833
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources...
EUVD-2025-210762
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources...
CVE-2025-68833 HCL Hive is affected by use of a cryptographic primitive with a risky implementation
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources...
CVE-2025-68833
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control , which could allow an unauthenticated, remote attacker to gain unauthorized access to resources . The CVSS 3.1 score is 5.3 (Medium) , reflecting a network attack vector with low complexity, no privileges or...