CVE-2026-18209 Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect OIDC authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. Whe...

Improper Validation of Consistency within Input

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input during OIDC authentication flow processing. An attacker can...

CVE-2025-59943

CVE-2025-59943 affects phpMyFAQ prior to 4.0.13. Versions 4.0-nightly-2025-10-03 and earlier fail to enforce unique email addresses during user registration, allowing multiple distinct accounts to share the same email. This can cause account ambiguity and, in certain configurations, may lead to p...