239 matches found
EUVD-2026-62516
IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 NIM server process is crashing during client registration due to buffer overflow...
CVE-2026-14970
The NIM server process in AIX 7.2/7.3 and PowerVM VIOS 4.1 crashes during client registration due to a buffer overflow, exploitable over the network with no authentication. CVSS 7.5 (HIGH) reflects high availability impact; no confidentiality or integrity impact is noted. IBM support page: https:...
CVE-2026-61466
CVE-2026-61466 affects Apache CXF’s OAuth2 Dynamic Client Registration endpoint. The authorization server stores the scope provided in a client registration request verbatim without validating it against an allowlist, enabling a client to self-assign privileged scopes at registration time. This c...
EUVD-2026-53861
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...
CVE-2026-61466 Apache CXF: OAuth2 Dynamic Client Registration Scope Self-Escalation
In Apache CXF's OAuth2 Dynamic Client Registration endpoint, the authorization server accepts and stores the scope value supplied in the client registration request verbatim, without validating it against an AS-defined allowlist. This could lead to a client self-assigning privileged scopes at...
keycloak-services: keycloak-services: Default DCR policy allows role forgery via User Property mappers
A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...
keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...
keycloak-services: keycloak-services: Default DCR policy allows role forgery via User Property mappers
A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...
keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...
CVE-2026-15572
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...
CVE-2026-16102
A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...
CVE-2026-15572
CVE-2026-15572 (Keycloak) affects Keycloak’s Dynamic Client Registration (DCR) policy management. The bug is in the "Allowed Protocol Mapper Types" policy: during a client update, if the mapper’s configuration doesn’t change, re-validation of the mapper type is skipped, enabling an attacker with ...
EUVD-2026-53398
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...
CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...
CVE-2026-16102
Keycloak-DCR: The default Dynamic Client Registration policy allows forging roles via User Property mappers due to insufficient claim-path validation. This enables a standard-user with a limited Initial Access Token to write to sensitive internal claim locations, forging administrative roles in t...
EUVD-2026-53382
A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...
CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...
CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers
A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...
CVE-2026-16102
A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...
CVE-2026-15572
A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...