PT-2026-96043

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Admin REST API of Keycloak. The API utilizes a per-request in-memory cache to resolve clients by their unique identifier but fails to verify if the client belongs to the...

PT-2026-96048

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the User-Managed Access UMA implementation. The issue occurs at the authorization token endpoint when processing permission tickets. If two different users own resources wit...

PT-2026-96042

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the Authorization Services component of Keycloak allows a delegated administrator with limited viewing privileges to access the full profile and role information of any user in the...

PT-2026-96049

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw in the authentication session management allows users to bypass mandatory security requirements, such as two-factor authentication 2FA setup, enforced via client policies. By manually...

CVE-2026-94218: Missing Authorization

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication 2FA setup, through a client policy. A user can bypass this...

CVE-2026-94217: Missing Authorization

A flaw was found in the User-Managed Access UMA implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission tickets. If two different users own resources with the same name, the system incorrectly merges the permissions from both resources when one...

CVE-2026-94213: Missing Authorization

A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy evaluation endpoint, which is used by administrators to test how access policies apply to specific users. Due to missing authorization check...

GHSA-QP49-QGX5-5M26 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, ruby3.3-bouncy-castle-java, druid, ruby3.2-bouncy-castle-java, logstash, apache-pulsar, spark, ruby4.0-bouncy-castle-java, keycloak, ruby3.4-bouncy-castle-java, opensearch, zipkin...

CVE-2026-8763 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, ruby3.3-bouncy-castle-java, druid, ruby3.2-bouncy-castle-java, logstash, apache-pulsar, spark, ruby4.0-bouncy-castle-java, keycloak, ruby3.4-bouncy-castle-java, opensearch, zipkin...

CVE-2026-13506 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, ruby3.3-bouncy-castle-java, druid, ruby3.2-bouncy-castle-java, logstash, apache-pulsar, spark, ruby4.0-bouncy-castle-java, keycloak, ruby3.4-bouncy-castle-java, opensearch, zipkin...

GHSA-9PWP-9QQC-PR26 vulnerabilities

Vulnerabilities for packages: kserve-modelmesh, ruby3.3-bouncy-castle-java, druid, ruby3.2-bouncy-castle-java, logstash, apache-pulsar, spark, ruby4.0-bouncy-castle-java, keycloak, ruby3.4-bouncy-castle-java, opensearch, zipkin...

CVE-2026-93999

A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...

CVE-2026-94000

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CVE-2026-94001

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

CVE-2026-94001

A flaw in the Admin REST API of Keycloak (an open-source identity and access management solution) allows a delegated administrator to bypass fine-grained reset-password permissions. The endpoint used for deleting user credentials fails to properly check these permissions, enabling an administrato...

EUVD-2026-83602

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

CVE-2026-94001 Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

CVE-2026-94001 Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from...

CVE-2026-94000

A flaw in the Admin REST API of Keycloak (open-source identity and access management) exists in the group-membership endpoints . The system fails to check whether a group grants administrative privileges before allowing a user to be added to it. This allows a delegated administrator holding the m...

EUVD-2026-83601

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...