CLEANSTART-2026-MO09576 Security fix for CVE-2026-55856 applied in: keycloak 26.5.7-r8

Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100907

Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-102176

Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100602

Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100325

Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101138

Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-101533

Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details...

PT-2026-100351

Security vulnerability affects the keycloak package. This issue is resolved in later releases. See references for vulnerability details...

keycloak v26.7.4

Open Source Identity and Access Management Add authentication to applications and secure services with minimum effort. No need to deal with storing users or authenticating users. Keycloak provides user federation, strong authentication, user management, fine-grained authorization, and more. Help...

CVE-2026-90997

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-90997 Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

EUVD-2026-82396

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-90997 Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-90997

Keycloak deployments in stateless mode with MySQL or MariaDB are affected by a replay protection bypass caused by a mismatch in row-count semantics between the database driver and Keycloak's application logic. An attacker who intercepts single-use security artifacts—such as JWT client assertions ...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (26.7.3.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (26.7.3.0) +48 more potentially affected by CVE-2026-90997 via org.keycloak:keycloak-model-jpa (>=26.7.0, <=26.7.3)

org.keycloak:keycloak-model-jpa MAVEN version =26.7.0, =6.0.0, =6.0.0, =3.0.0, =0.3.0, =0.1.3, =9.6, =9.6, =26.7.0, =26.7.0, =26.7.0, =26.7.0, =26.7.0, =26.7.0, =26.7.3 and more Source cves: CVE-2026-90997https://vulners.com/cve/CVE-2026-9099...

Linux Distros Unpatched Vulnerability : CVE-2026-19607

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a...

CVE-2026-90997: Authentication Bypass by Capture-replay

A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an attacker who intercepts single-use...

CVE-2026-19607

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-17526

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

CVE-2026-19607

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...