CVE-2026-89298

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

PT-2026-89870

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-89298: Exposure of Sensitive Information to an Unauthorized Actor

A flaw was found in the Dynamic Client Registration service of Keycloak, an open-source identity and access management solution. The issue occurs when a user with the view-clients role accesses the client registration endpoint to retrieve client details. Due to a failure to mask sensitive...

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770 Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770

Keycloak 's Device Authorization Grant flow contains a flaw where the token redemption process does not verify whether a user account is currently locked due to brute-force protection . An attacker holding an active session for a locked account can complete the device login flow and obtain new se...

EUVD-2026-75289

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-88770

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

Exploit for CVE-2026-18963

CVE-2026-18963 — Keycloak Reset-Credentials Flow Bypass Lab...

GHSA-FCCG-MWVH-QQG4 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, sonarqube, druid, flyway, cassandra, trino, tez, strimzi-kafka-operator, akhq, keycloak, spark, zookeeper...

GHSA-C4C3-7FPV-J4Q5 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, sonarqube, druid, flyway, cassandra, trino, tez, strimzi-kafka-operator, akhq, keycloak, spark, zookeeper...

CVE-2026-75595 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, sonarqube, druid, flyway, cassandra, trino, tez, strimzi-kafka-operator, akhq, keycloak, spark, zookeeper...

CVE-2026-75596 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, sonarqube, druid, flyway, cassandra, trino, tez, strimzi-kafka-operator, akhq, keycloak, spark, zookeeper...

CVE-2026-88770: Improper Restriction of Excessive Authentication Attempts

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

PT-2026-89299

A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and access management solution. The issue occurs because the token redemption process fails to check if a user account is currently locked due to brute-force protection. If an attacker has an active session for a...

CVE-2026-19729

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (26.7.3.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (26.7.3.0) +76 more potentially affected by CVE-2026-19729 via org.keycloak:keycloak-services (>=26.7.0, <=26.7.2)

org.keycloak:keycloak-services MAVEN version =26.7.0, =6.0.0, =6.0.0, =2.8.4, =3.0.0, =0.7.0, =2.3.0, =1.11.30, =1.3.0, =0.3.0, =0.1.3, =1.3.0, =1.4.0 - io.github.hqqw2h-lgtm:keycloak-services-social-wecom 0.1.0 and more Source cves: CVE-2026-19729 Source advisory: MEND:CVE-2026-19729...

EUVD-2026-74756

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...

CVE-2026-19729 Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters

A flaw was found in the key provider component of the keycloak-services library, which is the core engine for the Red Hat Build of Keycloak. The issue occurs because a previous fix for path probing was incomplete, allowing a realm administrator to still submit arbitrary filesystem paths as keysto...