8 matches found
CVE-2026-18215
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...
EUVD-2026-51480
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...
CVE-2026-18215
CVE-2026-18215 affects Keycloak (Keycloak-services) where the tenant-restriction for Microsoft accounts is bypassed via the token-exchange feature. A valid Microsoft token from a different organization can be used to access the Keycloak realm, potentially exposing sensitive data or enabling unaut...
CVE-2026-18215 Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...
CVE-2026-18215
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...
CVE-2026-18215
Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...
PT-2025-5380 · Akamai · Akamai Enterprise Application Access
Name of the Vulnerable Software and Affected Versions: Akamai Enterprise Application Access EAA versions prior to 2025-01-17 Description: An issue was discovered in Akamai Enterprise Application Access EAA. If an administrator knows another tenant's 128-bit connector GUID, they can execute debug...
CVE-2017-14105
HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at...