BIT-KEYCLOAK-2026-18209 Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

WordPress Welcart e-Commerce plugin < 2.12.1 - Session Fixation via uscesid Parameter vulnerability

Session Fixation via uscesid Parameter vulnerability discovered by bRpsd in WordPress Plugin Welcart e-Commerce versions 2.12.1...

CVE-2026-18918 OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked can create a...

CVE-2026-18918 OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked can create a...

CVE-2026-18918 OAuth 1.0 session-fixation chain via unauthenticated provisional-consumer registration and insecure v1_0Allowed default

In Eclipse Lyo versions 2.0.0 to 7.0.0, OAuth server authorization checks can be bypassed when the 2-legged auth is supported by the server. In those cases, application that based their authz filters upon Lyo-provided AbstractAdapterCredentialsFilter, are vulnerable. An attacked can create a...

CVE-2026-18918

Eclipse Lyo versions 2.0.0 through 7.0.0 are affected by an OAuth 1.0 authorization bypass in the 2-legged authentication path. Applications relying on Lyo's AbstractAdapterCredentialsFilter are vulnerable because an unauthenticated attacker can register a provisional trusted client and immediate...

CVE-2026-18527: Session Fixation

IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert ARE for i could allow a remote attacker to gain elevated privileges, caused by ARE GUI component processing. An unauthenticated attacker can exploit this vulnerability to execute actions under another user's authenticate...

GHSA-M452-Q8C9-RG2F AsyncHttpClient stores cookie for an unrelated domain (cookie tossing) via ThreadSafeCookieStore

Impact A cookie tossing / cookie injection issue CWE-1275. ThreadSafeCookieStore stored a cookie under the value of its Domain attribute without verifying that the responding host is allowed to set a cookie for that domain RFC 6265 §5.3 step 6. A host the client connects to can therefore plant a...

BIT-KEYCLOAK-2026-7507 Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which...

BIT-KEYCLOAK-2024-7341 Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authenticati...

Improper Input Validation

Keycloak is vulnerable to Improper Input Validation. The vulnerability is due to the HTTP parameter pollution check ignoring the fragment portion of wildcard redirect URIs, allowing an attacker to inject duplicate security parameters that may cause improperly configured clients to trust...

CVE-2026-41839

CVE-2026-41839...

Security Bulletin: IBM Application Runtime Expert (ARE) for IBM i is vulnerable to a user gaining elevated privileges and sensitive information [CVE-2026-18527, CVE-2026-17203].

Summary IBM Application Runtime Expert ARE for IBM i is vulnerable to a user gaining elevated privileges due to ARE GUI component processing CVE-2026-18527 and allow an attacker to obtain sensitive information CVE-2026-17203 as described in the vulnerability details section. Vulnerability Details...

CVE-2025-15671

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

CVE-2025-15671 Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

CVE-2025-15671 Welcart e-Commerce < 2.12.1 - Session Fixation via uscesid Parameter

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

EUVD-2025-210759

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

CVE-2025-15671

The Welcart e-Commerce WordPress plugin, in versions before 2.12.1 , is vulnerable to a session fixation attack. The flaw exists because the plugin fails to regenerate the session identifier upon authentication and allows the session identifier to be set from a user-supplied request parameter (sp...

CVE-2025-15671: Improper Authentication

The Welcart e-Commerce WordPress plugin before 2.12.1 does not regenerate the session identifier on authentication and sets the session identifier from a user-supplied request parameter, allowing an unauthenticated attacker to fixate a shop member's session and take over their customer account...

EUVD-2026-63221

An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have expired. This increases the risk associated with stolen, leaked, shared, or unattended sessions and may enable unauthorized continued access to the FDS web...