Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121

Summary The terraform-provider-argocd might have been vulnerable to GO-2026-4337 / CVE-2025-68121 "Unexpected session resumption in crypto/tls". Details See https://pkg.go.dev/vuln/GO-2026-4337 for the upstream vulnerability. Provider versions starting with v7.15.1 are using go 1.25.8 for buildin...

GHSA-594F-3595-C47V Terraform Provider for ArgoCD has possible exposure to GO-2026-4337 / CVE-2025-68121

Summary The terraform-provider-argocd might have been vulnerable to GO-2026-4337 / CVE-2025-68121 "Unexpected session resumption in crypto/tls". Details See https://pkg.go.dev/vuln/GO-2026-4337 for the upstream vulnerability. Provider versions starting with v7.15.1 are using go 1.25.8 for buildin...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

GHSA-X4P7-7CHP-64HQ Keycloak: Unauthorized authentication via disabled SAML Identity Provider

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...

EUVD-2026-12690

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...

Keycloak: Unauthorized authentication via disabled SAML Identity Provider

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...

de.adorsys.keycloak:keycloak-clientregistration-provider (>=1.2, <=3.0), de.adorsys.keycloak:keycloak-provider-extension (>=1.2, <=3.0) +8 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-services (3.4.3.final)

org.keycloak:keycloak-services MAVEN version 3.4.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.keycloak:keycloak-clientregistration-provider =1.2, =1.2, =0.0.1, =0.0.1, =0.0.1,...

CVE-2026-2603

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...

CVE-2026-2603

CVE-2026-2603 affects Keycloak: an attacker can bypass security by sending a valid SAML response from an external IdP to the Keycloak SAML endpoint for IdP-initiated broker logins, enabling unauthorized authentication. The issue is described across multiple sources (NVD/EUVD/GHSA) with a CVSS v3....

CVE-2026-2603 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...

CVE-2026-2603 Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...

CVE-2026-2603

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider IdP to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity...

PT-2026-25968

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A security bypass exists in Keycloak where a remote attacker can circumvent security measures by submitting a valid Security Assertion Markup Language SAML response from an external Identity...

PT-2026-26059

Name of the Vulnerable Software and Affected Versions Juju versions 3.0.0 through 3.6.18 Description Juju versions 3.0.0 through 3.6.18 are susceptible to a confused deputy issue stemming from predictable secret IDs XIDs. When a secret owner grants permissions to a secret to a grantee, the owner...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the DefaultHtmlErrorResponseBodyProvider class. An attacker can exhaust heap memory and cause a crash by sending requests that trigger exceptions with attacker-controlled messages...

Exposure of Resource to Wrong Sphere

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere due to improper handling of the session token cookie path. An attacker can gain unauthorized access ...

Exposure of Resource to Wrong Sphere

Overview apache-airflow-providers-amazon is a Provider for Apache Airflow. Implements apache-airflow-providers-amazon package Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere due to improper handling of the session token cookie path. An attacker can gain...

GHSA-29R8-GVX4-R9W3 Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider...

Authentication Bypass in extension "E-Mail MFA Provider" (mfa_email)

The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider...

CVE-2026-4208

The extension fails to properly reset the generated MFA code after successful authentication. This leads to a possible MFA bypass for future login attempts by providing an empty string as MFA code to the extensions MFA provider...