Moodle Multi-Factor Authentication Unauthorized Access

The vulnerability of the Multi-Factor Authentication component in the virtual learning environment Moodle is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected information...

Moodle Multi-Factor Authentication DoS

The vulnerability of the Multi-Factor Authentication component in the virtual learning environment Moodle relates to bypassing authentication using a key controlled by the user. Exploiting this vulnerability could allow a malicious actor to trigger a service failure...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.11 Images Update

New images are available for Red Hat build of Keycloak 26.0.11 and Red Hat build of Keycloak 26.0.11 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

org.keycloak.authentication: Two factor authentication bypass

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.11 Update

New Red Hat build of Keycloak 26.0.11 packages are available from the Customer Portal Red Hat build of Keycloak 26.0.11 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

GHSA-FX44-2WX5-5FVP Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5jfq-x6xp-7rw2. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required...

Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5jfq-x6xp-7rw2. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required...

CVE-2025-3910

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

CVE-2025-3910 Org.keycloak.authentication: two factor authentication bypass

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

CVE-2025-3910 Org.keycloak.authentication: two factor authentication bypass

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

CVE-2025-3910 Org.keycloak.authentication: two factor authentication bypass

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

CVE-2025-3910

CVE-2025-3910 (Keycloak) a vulnerability in the org.keycloak.authorization package may allow bypassing required actions (e.g., two-factor authentication). The issue enables an authenticated/user action bypass that could undermine enforced security policies. The CVSSv3.1 base score is 5.4 (Medium)...

CVE-2025-3910

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication. Mitigation No current mitigations are available for this vulnerability...

CVE-2025-3910: Improper Authentication

A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication...

Keycloak 安全漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak has a security vulnerability that stems from the org.keycloak.authorization package that may bypass required operations and could lead to bypassing two-factor authentication...

PT-2025-18208

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw was found in Keycloak, specifically in the org.keycloak.authorization package, which may be vulnerable to circumventing required actions. This allows users to bypass requirements such...

"Cannot Complete your request" during enumeration for DUO OAuth in 2 factor setup

Getting " Cannot complete your request" after duo push is successfully sent. In the url tab, we could see the client connection being pointed to storefront successfully...

CVE-2025-27538

Mattermost versions 10.5.x = 10.5.1, 9.11.x = 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with editotherusers permission to activate or deactivate MFA for other users, even if those users have not...

GHSA-X45J-JQ9Q-GF3Q Moodle makes some user data available before completing second factor with MFA enabled

A security vulnerability was discovered in Moodle that allows some users to access sensitive information about other students before they finish verifying their identities using two-factor authentication 2FA...

Improper Authentication

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Improper Authentication due to improper enforcement of multi-factor authentication during the self-enrollment process. An attacker can bypass the intended security controls by exploiting this weakne...