io.hawt.examples:hawtio-example-quarkus-keycloak (5.3.0), io.quarkus:quarkus-keycloak-authorization (>=3.39.0, <=3.39.1) +15 more potentially affected by CVE-2026-19625 via io.quarkus:quarkus-oidc (>=3.39.0, <=3.39.1)

io.quarkus:quarkus-oidc MAVEN version =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.39.0, =3.5.3, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.1.0 and more Source cves: CVE-2026-19625 Source advisory: MEND:CVE-2026-19625...

io.quarkus:quarkus-amazon-lambda-http (1.2.0.cr1), io.quarkus:quarkus-amazon-lambda-http-deployment (1.2.0.cr1) +49 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-vertx-http (1.2.0.cr1)

io.quarkus:quarkus-vertx-http MAVEN version 1.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.2.0.cr1 - io.quarkus:quarkus-amazon-lambda-http-deploymen...

io.quarkus:quarkus-keycloak-authorization-deployment (>=3.21.0.cr1, <=3.27.4), org.jboss.pnc:repository-driver (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-50559 via io.quarkus:quarkus-keycloak-authorization (>=3.21.0.cr1, <=3.27.4)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.21.0.cr1, =3.21.0.cr1, =3.2.0, =3.3.0 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375077...

io.quarkus:quarkus-keycloak-authorization-deployment (3.37.0.cr1) potentially affected by CVE-2026-50559 via io.quarkus:quarkus-keycloak-authorization (3.37.0.cr1)

io.quarkus:quarkus-keycloak-authorization MAVEN version 3.37.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-keycloak-authorization and may be impacted: - io.quarkus:quarkus-keycloak-authorization-deployment 3.37.0.cr1 Source...

com.abavilla:fpi-bot-api (>=1.6.0, <=1.8.5), com.abavilla:fpi-bot-api-parent (>=1.6.0, <=1.8.5) +19 more potentially affected by CVE-2026-50559 via io.quarkus:quarkus-keycloak-authorization (>=3.0.0.alpha1, <=3.20.6.1)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.0.0.alpha1, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.0.25, =1.0.25, =1.5.0, =1.5.0, =1.3.1, =1.3.1, =1.3.4, =1.3.13 and more Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375077...

Path Equivalence

Overview Affected versions of this package are vulnerable to Path Equivalence in the pathWithoutMatrixParams of AbstractPathMatchingHttpSecurityPolicy via specially crafted HTTP requests containing encoded semicolons, slashes, or backslashes in the request path. An attacker can gain unauthorized...

io.quarkus:quarkus-keycloak-authorization-deployment (>=3.34.0.cr1, <=3.36.2) potentially affected by CVE-2026-50559 via io.quarkus:quarkus-keycloak-authorization (>=3.34.0.cr1, <=3.36.2)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.34.0.cr1, =3.34.0.cr1, =3.36.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375077...

ai.wanaku:wanaku-router-backend (0.2.0), io.quarkus:quarkus-keycloak-authorization-deployment (>=3.28.0.cr1, <=3.33.2) potentially affected by CVE-2026-50559 via io.quarkus:quarkus-keycloak-authorization (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.28.0.cr1, =3.28.0.cr1, =3.33.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375077...

com.abavilla:fpi-bot-api (>=1.6.0, <=1.8.5), com.abavilla:fpi-bot-api-parent (>=1.6.0, <=1.8.5) +19 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-keycloak-authorization (>=3.0.0.alpha1, <=3.20.6)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.0.0.alpha1, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.0.25, =1.0.25, =1.5.0, =1.5.0, =1.3.1, =1.3.1, =1.3.4, =1.3.13 and more Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420251...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when handling HTTP request paths that have had normalizedPath applied. An attacker can gain unauthorized access to protected resources by appending a semicolon and arbitrary text to the request URL, exploiting...

io.quarkus:quarkus-amazon-lambda-http (1.1.0.final), io.quarkus:quarkus-amazon-lambda-http-deployment (1.1.0.final) +117 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-vertx-http (1.1.0.final)

io.quarkus:quarkus-vertx-http MAVEN version 1.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx-http and may be impacted: - io.quarkus:quarkus-amazon-lambda-http 1.1.0.final -...

io.quarkus:quarkus-keycloak-authorization-deployment (>=3.35.0.cr1, <=3.35.0) potentially affected by CVE-2026-39852 via io.quarkus:quarkus-keycloak-authorization (>=3.35.0.cr1, <=3.35.0)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.35.0.cr1, =3.35.0.cr1, =3.35.0 Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420251...

io.quarkus:quarkus-keycloak-authorization-deployment (>=3.34.0.cr1, <=3.34.6) potentially affected by CVE-2026-39852 via io.quarkus:quarkus-keycloak-authorization (>=3.34.0.cr1, <=3.34.6)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.34.0.cr1, =3.34.0.cr1, =3.34.6 Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420251...

io.quarkus:quarkus-keycloak-authorization-deployment (>=3.28.0, <=3.33.1) potentially affected by CVE-2026-39852 via io.quarkus:quarkus-keycloak-authorization (>=3.28.0, <=3.33.1)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.28.0, =3.28.0, =3.33.1 Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420251...

io.quarkus:quarkus-keycloak-authorization-deployment (>=3.21.0, <=3.27.3), org.jboss.pnc:repository-driver (>=3.2.0, <=3.3.0) potentially affected by CVE-2026-39852 via io.quarkus:quarkus-keycloak-authorization (>=3.21.0, <=3.27.3)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.21.0, =3.21.0, =3.2.0, =3.3.0 Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420251...

io.quarkus:quarkus-keycloak-authorization (>=3.35.0.cr1, <=3.35.0), io.quarkus:quarkus-keycloak-authorization-deployment (>=3.35.0.cr1, <=3.35.0) +7 more potentially affected by CVE-2026-39852 via io.quarkus:quarkus-oidc (>=3.35.0.cr1, <=3.35.0)

io.quarkus:quarkus-oidc MAVEN version =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0.cr1, =3.35.0 Source cves: CVE-2026-39852 Source advisory: SNYK:JAVA-IOQUARKUS-16420252...

EUVD-2026-10869

Parse Server missing audience validation in Keycloak authentication adapter...

Access Control Bypass

Overview org.keycloak:keycloak-authz-policy-common is a KeyCloak AuthZ: Common Policy Providers Affected versions of this package are vulnerable to Access Control Bypass via insufficient authorization checks on the /admin/realms/realm/roles endpoint. A remote authenticated attacker with...

io.quarkus:quarkus-keycloak-authorization (1.0.0.cr1), io.quarkus:quarkus-keycloak-authorization-deployment (1.0.0.cr1) +30 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (1.0.0.cr1)

io.quarkus:quarkus-vertx MAVEN version 1.0.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-keycloak-authorization 1.0.0.cr1 - io.quarkus:quarkus-keycloak-authorization-deployment...

io.quarkus:quarkus-keycloak-authorization (0.28.1), io.quarkus:quarkus-keycloak-authorization-deployment (0.28.1) +21 more potentially affected by CVE-2025-49574 via io.quarkus:quarkus-vertx (0.28.1)

io.quarkus:quarkus-vertx MAVEN version 0.28.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-vertx and may be impacted: - io.quarkus:quarkus-keycloak-authorization 0.28.1 - io.quarkus:quarkus-keycloak-authorization-deployment 0.28.1...