Keycloak 26.x < 26.0.10 / 26.1.x < 26.1.3 / 26.2.0 Improper Authorization

The version of Keycloak installed on the remote host is 26.0 prior to 26.0.10, 26.1 prior to 26.1.3, or prior to 26.2.0. It is, therefore, affected by an Improper Authorization vulnerability. A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an...

GHSA-RQ4W-CJRR-H8W8 Duplicate Advisory: Keycloak allows Incorrect Assignment of an Organization to a User

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gvgg-2r3r-53x7. This link is maintained to preserve external references. Original Description A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a...

Duplicate Advisory: Keycloak allows Incorrect Assignment of an Organization to a User

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gvgg-2r3r-53x7. This link is maintained to preserve external references. Original Description A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a...

Incorrect User Management

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect User Management in oidc/OrganizationMembershipMapper.java, which relies on matching the domain of a...

CVE-2025-1391

A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...

CVE-2025-1391

CVE-2025-1391 : The issue is an improper authorization in the Keycloak organization mapper, where a user can be misrepresented as belonging to an organization in tokens if their username or email matches the organization’s domain pattern. The flaw is confined to token claims and does not imply tr...

CVE-2025-1391 Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims

A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...

CVE-2025-1391 Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims

A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...

CVE-2025-1391 Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims

A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...

CVE-2025-1391

A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...

Keycloak 访问控制错误漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an access control error vulnerability that stems from a user-organization domain pattern mismatch in the organization function. An attacker exploiting this vulnerability could be...

CVE-2022-28693

CVE-2022-28693 is an information-disclosure vulnerability describing an unprotected alternative channel of return-branch target prediction on some Intel processors. The issue allows a locally authenticated user to potentially read sensitive memory. The primary context in the provided documents ti...

PT-2025-7053 · Zulip · Zulip

Name of the Vulnerable Software and Affected Versions: Zulip affected versions not specified Description: A weekly cron job in Zulip demotes channels to being "inactive" after they have not received traffic for 180 days. However, upon doing so, an event was sent to all users in the organization,...

CVE-2022-31631

In PHP versions 8.0. before 8.0.27, 8.1. before 8.1.15, 8.2. before 8.2.2 when using PDO::quote function to quote user-supplied data for SQLite, supplying an overly long string may cause the driver to incorrectly quote the data, which may further lead to SQL injection vulnerabilities...

CVE-2022-31631

CVE-2022-31631 affects PHP versions where PDO::quote() on SQLite can misquote long input, enabling potential SQL injection. Affected: PHP 8.0.x before 8.0.27, 8.1.x before 8.1.15, and 8.2.x before 8.2.2. The issue stems from incorrect quoting in the SQLite path, as documented in multiple advisori...

CVE-2020-3432

Cisco AnyConnect Secure Mobility Client for Mac OS contains a local-file corruption vulnerability in its uninstaller component caused by improper handling of directory paths. An authenticated, local attacker can exploit this by creating a symbolic link to a target file on a specific path, potenti...

CVE-2022-3180

The CVE-2022-3180 issue affects the WordPress WPGateway plugin (versions up to and including 3.5). The root cause is an unauthenticated privilege-escalation flaw that lets an attacker insert a malicious administrator account, enabling full site control as described across multiple sources. Exploi...

CVE-2022-3180

The WPGateway Plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 3.5. This allows unauthenticated attackers to create arbitrary malicious administrator accounts. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker...

Cross-site Scripting (XSS)

Overview ckan is a world’s leading Open Source data portal platform. It powers dozens of Open Data portals around the world, including data.gov, open.canada.ca and europeandataportal.eu but also regional, research and community organizations. It makes easy to publish, share and find data online a...

CVE-2024-2878

Summary (CVE-2024-2878) : A DoS vulnerability in GitLab CE/EE affects all versions from 15.7 up to 16.9.7, 16.10 up to 16.10.5, and 16.11 up to 16.11.2. An attacker could cause service disruption by crafting unusual branch-name search terms. Impact: availability loss as described in the sources. ...