keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

CVE-2024-4577

CVE-2024-4577 环境构建文件及PHP文件 --poc-- Invoke-WebRequest -Method POST -Headers @"Content-Type" = "application/x-www-form-urlencoded" -Body "" -Uri "http://localhost/test.php?%ADd+allowurlinclude%3D1+%ADd+autoprepend file%3Dphp://input"...

BIT-KEYCLOAK-2026-18209 Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

Astra Linux – Vulnerability in node-form-data

The use of insufficiently random values in form-data allows for HTTP Parameter Pollution HPP. This vulnerability is associated with the program file lib/formdata.Js. This issue affects form-data versions: 2.5.4, 3.0.0 – 3.0.3, 4.0.0 – 4.0.3...

GHSA-92HR-GMR6-H8CP Etherpad addressed weak token RNG, login timing, plugin path handling, API request handling

Fix: PR 7906 ether/etherpad. A set of medium/low hardening fixes: - Weak RNG for tokens CWE-330: author/session/readonly IDs were generated with Math.random client and server. Now use crypto.getRandomValues. - Login timing / no failure delay CWE-208/CWE-307: the OIDC interaction login used a...

CVE-2026-19594

Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...

EUVD-2026-57071

Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...

CVE-2026-19594

Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...

CVE-2026-19594 Path Traversal and HTTP Parameter Pollution in Snowflake Python API (snowflake.core) Allow Confused-Deputy Privilege Escalation

Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...

CVE-2026-19594

The CVE concerns the Snowflake Python API (snowflake.core) prior to version 1.13.0. It describes two weaknesses arising from insufficient input sanitization: path traversal (CWE-22) via unencoded “..” path segments and HTTP parameter pollution (CWE-141) via unencoded characters in query string va...

PT-2026-70996

Insufficient input sanitization in Snowflake Python API snowflake.core versions prior to 1.13.0 allowed confused-deputy privilege escalation through two related weaknesses: path traversal CWE-22 via unencoded .. identifier path segments, and HTTP parameter pollution CWE-141 via unencoded &//=...

keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers URIs, a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks...

keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604

A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers URIs, a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks...

EUVD-2026-51487

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

CVE-2026-18209 Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

CVE-2026-18209 Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

CVE-2026-18209

CVE-2026-18209 impacts the Keycloak service, specifically the component handling OpenID Connect (OIDC) flows. The flaw: the security check to prevent HTTP parameter pollution only examines the query string of a redirect URL, ignoring the fragment. With a wildcard redirect URI, an attacker can in...

CVE-2026-18217 Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can...

CVE-2026-18217

CVE-2026-18217 affects Keycloak’s SAML protocol implementation, specifically when handling SAML authentication requests via HTTP-Redirect binding with wildcard redirect URLs. The root cause is a query-string handling flaw that allows an attacker to craft a request whose parameters are preserved a...

PT-2026-66725

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the keycloak-services component of Keycloak regarding OpenID Connect OIDC authentication flows. The security check intended to prevent HTTP parameter pollution—a technique...