ECHO-C5C2-7377-0D26

Bulletin has no description...

ECHO-224B-7D14-E186

Bulletin has no description...

ECHO-D4AB-9594-A6A6

Bulletin has no description...

ECHO-1D5F-0C94-937D

Bulletin has no description...

ECHO-96F7-2B0E-5704

Bulletin has no description...

ECHO-DC91-3169-C604

Bulletin has no description...

ECHO-E0BB-5E4C-E923

Bulletin has no description...

ECHO-DE50-284B-655F

Bulletin has no description...

ECHO-C510-2382-A0DB

Bulletin has no description...

ECHO-B304-A795-3DAB

Bulletin has no description...

ECHO-86FC-E38B-C83B

Bulletin has no description...

ECHO-A405-9171-9BA2

Bulletin has no description...

ECHO-E419-5755-0224

Bulletin has no description...

ECHO-7E4D-4229-7370

Bulletin has no description...

ECHO-FEA2-5EA1-2849

Bulletin has no description...

ECHO-7EDB-23C5-02EC

Bulletin has no description...

ECHO-90F5-FFF7-E790

Bulletin has no description...

ECHO-73AB-600D-62BE Caught by Cursor Bugbot review on PR #19827: the real vulnerability (GHSA-7xf9-4jfc-wgm4) is specific to Fine-Grained Admin Permissions V2's RealmPermissionsV2 treating manage-clients as equivalent to managing the special "admin-permissions" client, which then grants realm-wide admin power. RealmPermissionsV2 and the admin-permissions client concept do not exist in 25.0.6 — its older RealmPermissions.canManageAuthorizationDefault() has no per-ResourceServer parameter at all (it's a single, undifferentiated realm-wide check), so there is no "is this the special admin-permissions client" distinction for a narrow, upstream-faithful fix to attach to. An earlier patch here unconditionally removed MANAGE_CLIENTS from that check to close the described escalation, but that changes intended authorization behavior for every regular client's authorization management, not just a vulnerable path (upstream's real fix leaves the MANAGE_CLIENTS grant intact for non-admin-permissions clients) — reverted.

Bulletin has no description...

ECHO-26F2-ACDE-46CC

Bulletin has no description...

ECHO-1969-C688-A45C Keycloak's GHSA advisory (GHSA-rr5q-3xwr-f323) lists the affected range as < 26.6.3 with no lower bound, so by version string alone 25.0.6 is nominally in range. The actual vulnerability requires a generic parameter-length-limiting mechanism (OIDCProviderConfig's max-length-per-parameter config, TokenEndpoint's checkParameters() gate) that silently drops any oversized request parameter, including subject_token — the fix exempts token-shaped parameters from that drop via a new getTokenParameterNames() method. That length-limiting framework does not exist anywhere in 25.0.6 (same finding as CVE-2026-4634, investigated separately) — confirmed via source search, no getMaxLengthForTheParameter/checkParameters/length-cap mechanism exists on any OIDC grant-type endpoint. With no mechanism to silently drop an oversized subject_token, the described fallback to client-credentials cannot occur.

Bulletin has no description...