DEBIAN-CVE-2026-104048

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

CVE-2026-104048 Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

CVE-2026-104048 Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

CVE-2026-104048

A vulnerability exists in SSSD within trust-enabled identity management environments. The system incorrectly evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. This allows an authenticated user from a trusted domain to bypass access...

CVE-2026-104048

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control HBAC rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account...

CVE-2021-3754

CVE-2021-3754 This repository documents Vulnerability details and exploit for CVE-2021-3754 discovered and reported by myself on 21st August 2021 Metrics CWE-20: Improper Input Validation CVSS: 5.3 MEDIUM Description A flaw was found in Apache Keycloak & Redhat SSO where an attacker is able to...

CVE-2026-19607

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

EUVD-2026-80855

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-19607

A flaw in the first-broker-login flow of the keycloak-services component in Red Hat build of Keycloak allows an attacker to register a matching username on an external identity provider, triggering a username collision that locks out the legitimate user. The root cause is insufficient validation ...

CVE-2026-19607 Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-19607 Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

keycloak-services: keycloak-services: Broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

keycloak-services: keycloak-services: Broker-originated username collision causes account lockout

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

PT-2026-93821

Name of the Vulnerable Software and Affected Versions keycloak-services affected versions not specified Description A flaw exists in the first-broker-login flow of the keycloak-services component, which manages initial authentication and account linking for users logging in via external identity...

CVE-2026-78606 Incorrect Authorization in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data

Incorrect Authorization CWE-863 in Kibana can lead to unauthorized disclosure, modification, and deletion of data via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. Where two authenticated principals originating from different authentication realms share the same username value...

BIT-KIBANA-2026-72643 Incorrect Authorization in Kibana Agent Builder Leading to Disclosure and Tampering of Private Agents

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

PT-2026-83385

In codefloe.com/crowci/crow/v6 before 6.4.0, user account lookup during forge login is not scoped to the authenticating forge. An account on one forge matches an existing user on another forge via forge remote ID collision or username collision. On instances with multiple configured forges, an...

CVE-2026-72643

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

CVE-2026-72643

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...

EUVD-2026-58288

Kibana Agent Builder determines whether a caller owns a private agent by comparing a stable user identifier when one is recorded, and falling back to a comparison of the username when it is not. A username is not unique across Elasticsearch authentication realms, so two distinct principals that...