keycloak

Gestión de identidad y acceso de código abierto Añade autenticación a aplicaciones y protege servicios con el mínimo esfuerzo. No necesitas ocuparte de almacenar usuarios ni de autenticarlos. Keycloak proporciona federación de usuarios, autenticación sólida, gestión de usuarios, autorización de...

Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE

Microsoft SharePoint Server 2016, 2019, Subscription Edition = 2026.3.1 contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint /trust/default.aspx. The SharePoint authentication module SPFederationAuthenticationModuleV2 uses a deflate-only...

sharepoint-2026-poc

SharePoint /trust WS-Federation 逆シリアル化: PoC & 検知ノート ライブレポート GitHub Pages: https://sp-poc.wismansec.com/ 本ドキュメントのHTMLレンダリング 影響を受ける製品: SharePoint Server 2016、2019、および Subscription Edition 隔離されたラボで SharePoint Server Subscription Edition への侵入を再現しました。目的は、a 攻撃者の完全な能力を理解すること、b...

POC-CVE-2026-32621-Apollo-Federation-XSS-Vulnerability

CVE-2026-32621 - Apollo Federation プロトタイプ汚染 PoC 概要...

adfsbrute

adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...

CVE-2026-47839

Cloud Foundry UAA and cf-deployment are vulnerable to a privilege-escalation flaw in federated OIDC authentication. When an OIDC identity provider is configured with groupMappingMode: AS_SCOPES and a wildcard externalGroupsWhitelist entry, users can obtain the uaa.admin scope despite operators in...

EUVD-2026-76026

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2026-73785

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

EUVD-2026-75977

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

CVE-2026-73785

HPE IceWall Federation Agent 4.0 and IceWall Federation Proxy 4.0 contain a denial-of-service vulnerability that can be triggered by a remote, unauthenticated attacker over the network with low complexity (CVSS 3.1: 7.5 HIGH ). Affected platforms include RHEL 7/8/9/10 and Windows. The impact is l...

CVE-2026-73785 HPE IceWall Federation Agent and Proxy, Denial of Service vulnerability

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

synapse

Synapse |support| |development| |documentation| |license| |pypi| |python| Synapse は現在 element-hq/synapse で積極的にメンテナンスされています Synapse は、Matrix.org Foundation の一環として2019年から2023年にかけて開発された、オープンソースの Matrix ホームサーバーです。Matrix.org Foundation は Synapse のメンテナンスにリソースを割くことができず、Element によって開発が継続されています 。また、他の...

HPESBMU05147 rev.1 - HPE IceWall products, Denial of Service vulnerability

Potential Security Impact: Remote: Denial of Service DoS SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. IceWall Federation Agent 4.0 RHEL7, RHEL8, RHEL9, RHEL10, Windows IceWall Federation Proxy 4.0 RHEL8, RHEL9, RHEL10, Windows CVSS Scores: | CVE | CVSS Vector | Base Score | | -...

HPESBMU05142 rev.1 - HPE IceWall products, Remote Bypass of Security Restrictions

Potential Security Impact: Remote: Bypass Security Restrictions SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. IceWall MFA 4.0 Enterprise Edition - SAML Authentication Option RHEL7, RHEL8, RHEL9, RHEL10, Windows IceWall MFA 4.0 Standard Edition - SAML Authentication Option RHEL7,...

CVE-2026-33693

CVE-2026-33693: activitypub-federation-rust の v4isinvalid における 0.0.0.0 バイパスによる SSRF CVSS 6.5 中 キーワード: SSRF, 0.0.0.0, IP 検証バイパス, activitypub-federation, Lemmy, Rust, ActivityPub 目次 概要 脆弱性の詳細 技術的分析 攻撃チェーン 影響 対策 CVSS v3.1 メトリクス タイムライン 参考情報 連絡先 免責事項 概要 activitypub-federation-rust ライブラリ Lemmy および 6...

CVE-2026-87049

A flaw was found in operator-foundry. Untrusted external actors can exploit over-permissive GitHub access tokens and Google Cloud Platform GCP Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking this workflow on untrusted-triggerable events without...

EUVD-2026-73251

Allocation of resources without limits or throttling in Active Directory Federation Services AD FS allows an unauthorized attacker to deny service over a network...

BIT-KEYCLOAK-2026-16442 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

Astra Linux – Vulnerability in rabbitmq-server

RabbitMQ is a multi-protocol messaging broker. In RabbitMQ-server prior to version 3.8.18, when a federation link was displayed in the RabbitMQ management UI through the rabbitmqfederationmanagement plugin, its consumer tag was rendered without proper tag sanitization. This potentially allows for...

CVE-2026-77810

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...