CVE-2026-92857 Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokens

Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their o...

CVE-2026-92857

The Keycloak-services Dynamic Client Registration (DCR) feature contains a vulnerability where protocol mapper configurations are not validated . This flaw allows individuals holding specific tokens to register malicious applications and map their own profile details to protected fields, such as ...

CVE-2026-5423

@neo4j/graphql library versions prior to 7.5.6 fail to verify the authenticity of a client-supplied, pre-decoded JWT object passed through GraphQL subscription connectionParams. As a result, any unauthenticated remote client that can open a GraphQL-over-WebSocket connection can forge arbitrary JW...