EUVD-2026-92258

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105306 Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105302

A flaw in the User Session Note mapper of the Keycloak identity and access management solution allows for the exposure of sensitive internal credentials. The mapper fails to validate if a requested session note contains federated access tokens from external identity providers. Consequently, a del...

CVE-2026-105302 Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105302 Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

EUVD-2026-92257

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105306

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105301 Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker-controlled crl-dp/ocsp urls

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

CVE-2026-105301 Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker-controlled crl-dp/ocsp urls

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

EUVD-2026-92255

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

CVE-2026-105301

A flaw exists in the X.509 client-certificate authenticator of Keycloak , an identity and access management solution. When configured to check certificate revocation via CRL Distribution Points or OCSP , the server may process a specially crafted certificate provided by an attacker. This causes K...

CVE-2026-105302

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

CVE-2026-105301

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

PT-2026-104725

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

CVE-2026-105301: Server-Side Request Forgery (SSRF)

A flaw was found in the X.509 client-certificate authenticator of Keycloak, a solution for identity and access management. The issue occurs when the server is configured to check certificate revocation using CRL Distribution Points or OCSP. An attacker can provide a specially crafted certificate...

PT-2026-104728

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Dynamic Client Registration flow of the Keycloak identity and access management server. The registration process fails to filter security-sensitive client attributes...

CVE-2026-105306: Missing Authorization

A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial Access Token can...

CVE-2026-105302: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

PT-2026-104727

A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mapper does not validate whether a requested session note contains sensitive internal credentials, such as federated access tokens from external identity provider...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: cass-config-builder-fips, hadoop-client-modules, knative-kafka-broker-fips, nacos-docker, pinot-fips, sonarqube, keycloak, wildfly, nacos, keycloak-fips, commercial-elasticsearch, cassandra-fips, pinot, request-9047-keycloak-fips, strimzi-kafka-operator, zaproxy,...