16064 matches found
GHSA-G8CF-RCJF-C8CF vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-dynamodb, crossplane-provider-aws-route53, crossplane-provider-aws-firehose, crossplane-provider-azure-authorization, gitness, crossplane-provider-azure-sql, crossplane-provider-keycloak, crossplane-provider-family-aws,...
GHSA-VRCC-3CH7-HPPW vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-dynamodb, crossplane-provider-aws-route53, crossplane-provider-aws-firehose, crossplane-provider-azure-authorization, gitness, crossplane-provider-azure-sql, crossplane-provider-keycloak, crossplane-provider-family-aws,...
GHSA-FH4F-47MF-F2GJ vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-dynamodb, crossplane-provider-aws-route53, crossplane-provider-aws-firehose, crossplane-provider-azure-authorization, gitness, crossplane-provider-azure-sql, crossplane-provider-keycloak, crossplane-provider-family-aws,...
GHSA-RJ39-CV6W-8WV7 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-dynamodb, crossplane-provider-aws-route53, crossplane-provider-aws-firehose, crossplane-provider-azure-authorization, gitness, crossplane-provider-azure-sql, crossplane-provider-keycloak, crossplane-provider-family-aws,...
CVE-2026-100347 vulnerabilities
Vulnerabilities for packages: crossplane-provider-aws-dynamodb, crossplane-provider-aws-route53, crossplane-provider-aws-firehose, crossplane-provider-azure-authorization, gitness, crossplane-provider-azure-sql, crossplane-provider-keycloak, crossplane-provider-family-aws,...
CVE-2026-18963
CVE-2026-18963 Keycloak Reset-Credentials State Bypass Detector https://github.com/user-attachments/assets/005fab89-339a-4e4e-881c-da6a626f6c9e python3 kc-resetforge.py -h usage: kc-resetforge.py -h --target TARGET --targets-file TARGETSFILE --port PORT --realm REALM --client-id CLIENTID --userna...
EUVD-2026-102520
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
EUVD-2026-102522
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...
CVE-2026-96806
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...
CVE-2026-92228
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
CVE-2026-96806 Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented token, but KeycloakJWTMiddleware then issued a new, unrevoked token on the same response, so the user stayed logged in. Deployments using the Keycloak auth manager are affected: afte...
CVE-2026-96806
The Apache Airflow Keycloak auth manager is vulnerable to a session management flaw where the logout route fails to terminate the user session. Although the logout route revokes the presented token, the KeycloakJWTMiddleware component issues a new, unrevoked token within the same response, effect...
CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
CVE-2026-92228 Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read
The Apache Airflow Keycloak provider's multi-team provisioning attachteampermissions granted every team role global read access to audit logs. Deployments that enable multi-team mode with the Keycloak auth manager and provision teams through it are affected: any authenticated member of one team...
CVE-2026-92228
The apache-airflow-providers-keycloak component is vulnerable due to an issue in the multi-team provisioning function (_attach_team_permissions). This flaw incorrectly grants every team role global read access to audit logs. Affected deployments are those that enable multi-team mode with the Keyc...
CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation
CVE-2026-1529 Keycloak Exploit Tool Keycloak: Unauthorized organization registration via improper invitation token validation Disclaimer This tool is for educational and security testing purposes only. Use only on systems you have explicit permission to test. Unauthorized access to computer syste...
CVE-2026-18963
CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab Tổng quan Lab mô phỏng lỗ hổng CVE-2026-18963 CVSS 9.1 trong Keycloak, cho phép kẻ tấn công chiếm quyền tài khoản bất kỳ thông qua bypass xác minh email trong luồng đặt lại mật khẩu. Chỉ sử dụng cho mục đích nghiên cứu bảo mật và giáo dụ...
Exploit-For-CVE-2026-18963
CVE-2026-18963 — Keycloak Unauthenticated Account Takeover CVSS 9.1 Critical · Keycloak 26.0.0 – 26.7.1 · Unauthenticated A critical vulnerability in Keycloak's reset-credentials flow that allows an unauthenticated attacker to take over any user account without email verification by chaining two...
keycloak-CVE-2026-18963
CVE-2026-18963 - Keycloak reset-credentials flow bypass Docker setup for testing Keycloak 26.x versions affected by the reset-credentials flow bypass. The included lab pins Keycloak 26.6.2 , which is in the affected range 26.0 and --username \ --new-password '' \ --allow-loopback-http-cookie...
CVE-2026-18963
Keycloak Reset Path Finder Nuclei template to discover exposed Keycloak reset-credentials endpoints across multiple proxy prefixes, context paths, realm names, and path variations. Summary This template helps identify reachable password reset flows that may be relevant during validation of...