BIT-KEYCLOAK-2026-18214 Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This mean...

BIT-KEYCLOAK-2026-18209 Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

BIT-KEYCLOAK-2026-18201 Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

BIT-KEYCLOAK-2026-17059 Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and access management solution. The issue occurs because the system fails to check if an administrator has permission to view individual users when listing members of...

BIT-KEYCLOAK-2026-16108 Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2

A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing groups that are automatically assigned to new users within a realm. The issue allows a delegated administrator with realm-viewing permissions to see the names and...

BIT-KEYCLOAK-2026-16106 Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, an attacker with limited administrative permissions can...

BIT-KEYCLOAK-2026-16105 Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remov...

BIT-KEYCLOAK-2026-16104 Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat Build of Keycloak identity and access management. The issue occurs because the system fails to mask sensitive configuration values, such as reCAPTCHA secret keys,...

BIT-KEYCLOAK-2026-16093 Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication. A flaw was discovered where this enforcement can be bypassed. An attacker with valid client credentials can provide a fake, unsigned...

BIT-KEYCLOAK-2026-16089 Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

BIT-KEYCLOAK-2026-16072 Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface...

Exploit for CVE-2026-18963

0day-Exploits Vulnerability research I have done on four wide...

Exploit for CVE-2026-18963

My-Exploits Vulnerability research I have done on four widely...

Keycloak -- multiple vulnerabilities

The Keycloak Team reports: CVE-2026-35563: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname CVE-2026-16093: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers CVE-2026-16072: Organization...

CVE-2026-55856 vulnerabilities

Vulnerabilities for packages: metabase, camunda-zeebe, flyway, request-9047-keycloak-fips, reposilite, airbyte-platform-fips, camunda, debezium, keycloak-fips, airbyte-platform, zipkin, keycloak, flyway-fips...

CVE-2026-55857 vulnerabilities

Vulnerabilities for packages: metabase, camunda-zeebe, flyway, request-9047-keycloak-fips, reposilite, airbyte-platform-fips, camunda, debezium, keycloak-fips, airbyte-platform, zipkin, keycloak, flyway-fips...

CVE-2026-55858 vulnerabilities

Vulnerabilities for packages: metabase, camunda-zeebe, flyway, request-9047-keycloak-fips, reposilite, airbyte-platform-fips, camunda, debezium, keycloak-fips, airbyte-platform, zipkin, keycloak, flyway-fips...

GHSA-G9JJ-CGMH-9F38 vulnerabilities

Vulnerabilities for packages: metabase, camunda-zeebe, flyway, request-9047-keycloak-fips, reposilite, airbyte-platform-fips, camunda, debezium, keycloak-fips, airbyte-platform, zipkin, keycloak, flyway-fips...

GHSA-QXVW-FVWX-5CP7 vulnerabilities

Vulnerabilities for packages: metabase, camunda-zeebe, flyway, request-9047-keycloak-fips, reposilite, airbyte-platform-fips, camunda, debezium, keycloak-fips, airbyte-platform, zipkin, keycloak, flyway-fips...

GHSA-XVR9-35CR-46V9 vulnerabilities

Vulnerabilities for packages: metabase, camunda-zeebe, flyway, request-9047-keycloak-fips, reposilite, airbyte-platform-fips, camunda, debezium, keycloak-fips, airbyte-platform, zipkin, keycloak, flyway-fips...