keycloak

开源身份与访问管理 以最少的努力为应用程序添加身份验证并保护服务安全。无需处理用户存储或用户身份验证。 Keycloak 提供用户联合、强身份验证、用户管理、细粒度授权等功能。 帮助与文档 文档 用户邮件列表 - 用于获取帮助和提出关于 Keycloak 一般问题的邮件列表 通过 https://slack.cncf.io/ 创建账户，加入 keycloak 提出一般问题，或在 Slack 上加入 keycloak-dev 进行设计与开发讨论。 报告安全漏洞 如果您发现了安全漏洞，请查看如何正确报告的说明。 报告问题 如果您认为发现了 Keycloak 的缺陷，请提出一个问题。...

CVE-2026-33693

CVE-2026-33693：activitypub-federation-rust v4isinvalid 中可通过 0.0.0.0 绕过的 SSRF 漏洞（CVSS 6.5 中危） 关键词： SSRF、0.0.0.0、IP 验证绕过、activitypub-federation、Lemmy、Rust、ActivityPub 目录 概述 漏洞详情 技术分析 攻击链 影响 修复建议 CVSS v3.1 指标 时间线 参考 联系方式 免责声明 概述 activitypub-federation-rust 库（被 Lemmy 及 6...

adfsbrute

adfsbrute A script to test credentials against Active Directory Federation Services ADFS, calculating the ADFS url of an organization and allowing password spraying or bruteforce attacks. The main idea is carrying out password spraying attacks with a random and high delay between each test and...

Microsoft SharePoint Server - WS-Federation BinaryFormatter Deserialization RCE

Microsoft SharePoint Server 2016, 2019, Subscription Edition = 2026.3.1 contains a remote code execution vulnerability in the WS-Federation passive sign-in endpoint /trust/default.aspx. The SharePoint authentication module SPFederationAuthenticationModuleV2 uses a deflate-only...

sharepoint-2026-poc

SharePoint /trust WS-Federation 反序列化：PoC 与检测笔记 在线文档（GitHub Pages）：https://sp-poc.wismansec.com/（本文档的 HTML 渲染）。 影响范围：SharePoint Server 2016、2019 和 Subscription Edition。 在隔离实验室中对 SharePoint Server（Subscription Edition）入侵的重现，旨在 a 了解攻击者的完整能力，b 确定防御者应搜寻的内容，包括隐蔽持久化，c 分享 PoC 以帮助其他调查人员。 仅限授权研究。...

CVE-2026-90679

A flaw was found in Forgejo when federation is enabled. This issue allows a remote attacker to spoof identities by submitting signature-valid ActivityPub activities attributed to any actor identity. The system fails to verify that the HTTP Signature on an incoming ActivityPub activity was produce...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4 with [federation] ENABLED = true contains a signature-spoofing flaw in its ActivityPub inbox processing. The HTTP Signature verification in routers/api/v1/activitypub/reqsignature.go validates the request, but inbox handlers then read the acting identity from the att...

EUVD-2026-76944

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

PT-2026-90787

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

POC-CVE-2026-32621-Apollo-Federation-XSS-Vulnerability

CVE-2026-32621 - Apollo Federation 原型污染 PoC 概述 字段| 值 ---|--- CVE| CVE-2026-32621 CVSS| 9.9 严重 CWE| CWE-1321（原型污染） 受影响版本| Apollo Federation 2.9.6、 2.10.5、 2.11.6、 2.12.3、 2.13.2 已修复版本| 2.9.6、2.10.5、2.11.6、2.12.3、2.13.2 GHSA| GHSA-pfjj-6f4p-rvmh 漏洞描述 Apollo Federation 的 deepMerge 函数（在...

CVE-2026-47839

Cloud Foundry UAA and cf-deployment are vulnerable to a privilege-escalation flaw in federated OIDC authentication. When an OIDC identity provider is configured with groupMappingMode: AS_SCOPES and a wildcard externalGroupsWhitelist entry, users can obtain the uaa.admin scope despite operators in...

EUVD-2026-76026

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: ASSCOPES with ...

CVE-2026-73785

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

EUVD-2026-75977

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

CVE-2026-73785

HPE IceWall Federation Agent 4.0 and IceWall Federation Proxy 4.0 contain a denial-of-service vulnerability that can be triggered by a remote, unauthenticated attacker over the network with low complexity (CVSS 3.1: 7.5 HIGH ). Affected platforms include RHEL 7/8/9/10 and Windows. The impact is l...

CVE-2026-73785 HPE IceWall Federation Agent and Proxy, Denial of Service vulnerability

A potential security vulnerability in HPE IceWall Federation Agent and Proxy could allow a remote unauthenticated attacker to cause a denial of service DoS...

synapse

========================================================================= Synapse |support| |development| |documentation| |license| |pypi| |python| Synapse 现已积极维护于 element-hq/synapse Synapse 是一个开源的 Matrix 家服务器，由 Matrix.org 基金会从 2019 年到 2023 年开发。Matrix.org 基金会无法继续维护 Synapse，其 由 Element 继续开发...

PT-2026-89813

A vulnerability allows users authenticating through a federated OIDC provider to obtain the uaa.admin scope despite operators restricting that provider through externalGroupsWhitelist configuration. The issue occurs specifically when an OIDC identity provider uses groupMappingMode: AS SCOPES with...