fulcio

Fulcio A Free-to-Use CA For Code Signing Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity, such as email address. Fulcio only issues short-lived certificates that are valid for 10 minutes. Public Instance Fulcio is in General...

CVE-2026-114619

A flaw was found in Authlib. This vulnerability allows an authenticated client to bypass authorization scope restrictions and obtain an unauthorized OpenID Connect OIDC identity token, leading to information disclosure. During an implicit grant authorization request, the application evaluates the...

CVE-2026-115360

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

EUVD-2026-108285

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

CVE-2026-115360

OpenBao versions before 2.6.3 are vulnerable to an open redirect vulnerability located in the UI's OIDC identity provider . This flaw impacts unauthenticated users , as attackers can craft malicious OIDC links to redirect them to attacker-controlled destinations, potentially facilitating phishing...

CVE-2026-115360 OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

CVE-2026-115360 OpenBao before 2.6.3 Open Redirect via OIDC Identity Provider UI

OpenBao before 2.6.3 contains an open redirect vulnerability in the UI's OIDC identity provider that affects users not authenticated to OpenBao. Attackers can craft OIDC links that redirect unauthenticated users to attacker-controlled destinations, enabling phishing or credential theft...

PT-2026-121540

Name of the Vulnerable Software and Affected Versions OpenBao versions prior to 2.6.3 Description The UI's OIDC identity provider allows unauthenticated users to be redirected to external, attacker-controlled destinations via specially crafted OIDC links. This issue can be leveraged to facilitate...

Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software

Summary Open source packages are used as part of the overall processing in DataStage on Cloud Pak for Data. Vulnerability Details CVEID:CVE-2025-66506 DESCRIPTION: Fulcio is a free-to-use certificate authority for issuing code signing certificates for an OpenID Connect OIDC identity. Prior to...

Authentication Bypass

Red Hat Build of Keycloak is vulnerable to an authentication bypass. The vulnerability is due to improper validation of cryptographic signatures when an OIDC identity provider is configured to skip signature validation, which allows an attacker with knowledge of specific session details to send a...

CVE-2026-18569

A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature...

Improper Verification of Cryptographic Signature

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the backchannel logout endpoint of the keycloak-services...

CVE-2026-15943: Improper Validation of Consistency within Input

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

Improper Validation of Consistency within Input

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input in the identity provider update flow for OIDC identity...