254545 matches found
ECHO-6E54-DE1B-08C9
Bulletin has no description...
ECHO-1969-C688-A45C Keycloak's GHSA advisory (GHSA-rr5q-3xwr-f323) lists the affected range as < 26.6.3 with no lower bound, so by version string alone 25.0.6 is nominally in range. The actual vulnerability requires a generic parameter-length-limiting mechanism (OIDCProviderConfig's max-length-per-parameter config, TokenEndpoint's checkParameters() gate) that silently drops any oversized request parameter, including subject_token — the fix exempts token-shaped parameters from that drop via a new getTokenParameterNames() method. That length-limiting framework does not exist anywhere in 25.0.6 (same finding as CVE-2026-4634, investigated separately) — confirmed via source search, no getMaxLengthForTheParameter/checkParameters/length-cap mechanism exists on any OIDC grant-type endpoint. With no mechanism to silently drop an oversized subject_token, the described fallback to client-credentials cannot occur.
Bulletin has no description...
ECHO-4C35-FCD8-CA55
Bulletin has no description...
ECHO-6280-5637-DD2F
Bulletin has no description...
ECHO-C70D-0DFC-E7D7
Bulletin has no description...
ECHO-1814-DA4F-7983
Bulletin has no description...
ECHO-B09D-C689-B716
Bulletin has no description...
ECHO-F035-45D7-D0F3
Bulletin has no description...
ECHO-2426-223E-D79F
Bulletin has no description...
ECHO-738B-62C7-508F
Bulletin has no description...
ECHO-BD3C-E7A2-8A3A
Bulletin has no description...
ECHO-70DF-01DF-0CB2
Bulletin has no description...
ECHO-8C0B-1F50-633C
Bulletin has no description...
ECHO-69CC-B026-014F
Bulletin has no description...
ECHO-2E54-CE79-4B18
Bulletin has no description...
ECHO-B064-B0C5-7B0F
Bulletin has no description...
ECHO-8443-C7B2-28C5
Bulletin has no description...
ECHO-4A9E-3A8A-145E
Bulletin has no description...
ECHO-DC8F-BECE-24E2
Bulletin has no description...
ECHO-B87A-6495-4598 Flagged by review on PR #19827: this ID needs a documented disposition here, not silent removal, since the raw scanner (matching on [email protected]'s version string alone) will otherwise keep reporting it as an open finding forever. Upstream's fix (GHSA-gvgg-2r3r-53x7) closes a path where OrganizationMemberResource trusted a client-session note to determine organization membership, letting a crafted note forge an org claim. 25.0.6's OrganizationMembershipMapper does not have that trust path at all — it always re-verifies membership directly against the organization store (provider.getByMember(user)) rather than trusting anything client- or session-supplied. With no client-session-note-based membership check present, the described forgery has no mechanism to exploit here.
Bulletin has no description...