Malicious Package

Overview statist-browser-typed-client-rubliq.platform.keycloak is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between th...

MAL-2026-12451 Malicious code in statist-browser-typed-client-rubliq.platform.keycloak (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fc008dc0448aacf1e76c6111e7644f91d077009d358a0085be46166e92ce59cf The package presents itself as a Keycloak typed client but on require executes a binary dropper. index.js loads adapter.js, which reconstructs...

CVE-2026-46389

CVE-2026-46389 affects UDS Identity Config (Keycloak integration) used by UDS Core Identity. A logic error in the Keycloak client authenticator named client-kubernetes-secret (shipped by uds-identity-config) in versions 0.11.0–0.26.0 overwrites the submitted client_secret with the mounted Kuberne...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.11), com.github.vzakharchenko:cisco-radius-plugin (1.4.11) +62 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-server-spi-private (21.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.11 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.11), com.github.vzakharchenko:cisco-radius-plugin (1.4.11) +62 more potentially affected by CVE-2026-9704 via org.keycloak:keycloak-server-spi-private (21.0.0)

org.keycloak:keycloak-server-spi-private MAVEN version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.11 -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (2.0.0), fr.cnieg.keycloak:attribute-login-provider (1.3.5) +59 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (21.1.2)

org.keycloak:keycloak-server-spi-private MAVEN version 21.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 2.0.0 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (4.0.2-25.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (4.0.2-25.0) +33 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (25.0.4)

org.keycloak:keycloak-server-spi-private MAVEN version 25.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension 4.0.2-25.0 -...

fr.cnieg.keycloak:attribute-login-provider (>=1.3.9, <=1.3.10), io.phasetwo.keycloak:keycloak-events (>=0.21, <=0.22) +41 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (22.0.5)

org.keycloak:keycloak-server-spi-private MAVEN version 22.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-server-spi-private and may be impacted: - fr.cnieg.keycloak:attribute-login-provider =1.3.9, =0.21, =0.44, =3.2.8.final,...

PT-2025-22564

Name of the Vulnerable Software and Affected Versions zot versions prior to 2.1.3 Description The issue concerns the exposure of the Keycloak client secret in the container stdout logs at startup when using Keycloak as an OIDC provider. This occurs due to a flaw in handling sensitive information...

org.keycloak:keycloak-adapter-core (1.9.0.cr1), org.keycloak:keycloak-admin-client (1.9.0.cr1) +42 more potentially affected by CVE-2024-7318 via org.keycloak:keycloak-core (1.9.0.cr1)

org.keycloak:keycloak-core MAVEN version 1.9.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 1.9.0.cr1 - org.keycloak:keycloak-admin-client 1.9.0.cr1 -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.7.3), io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (1.2.6.final) +55 more potentially affected by CVE-2024-7318 via org.keycloak:keycloak-core (1.9.4.final)

org.keycloak:keycloak-core MAVEN version 1.9.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.7.3 -...

com.gitblit.fathom:fathom-security-keycloak (>=0.8.4, <=1.0.1), org.commonjava.indy.embed:indy-embedder (>=1.3.0, <=1.5.0.3) +54 more potentially affected by CVE-2024-7318 via org.keycloak:keycloak-core (1.9.8.final)

org.keycloak:keycloak-core MAVEN version 1.9.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.gitblit.fathom:fathom-security-keycloak =0.8.4, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0, =1.1.0,...

io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.4.final, <=1.2.6.beta1), io.apiman:apiman-distro-eap7 (>=1.2.4.final, <=1.2.6.beta1) +48 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (1.9.2.final)

org.keycloak:keycloak-core MAVEN version 1.9.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman.plugins:apiman-plugins-keycloak-oauth-policy =1.2.4.final, =1.2.4.final, =1.2.4.final,...

org.keycloak:keycloak-adapter-core (1.9.5.final), org.keycloak:keycloak-admin-client (1.9.5.final) +43 more potentially affected by CVE-2023-6927 via org.keycloak:keycloak-core (1.9.5.final)

org.keycloak:keycloak-core MAVEN version 1.9.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 1.9.5.final - org.keycloak:keycloak-admin-client 1.9.5.final -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.7.2), org.keycloak:keycloak-adapter-core (1.9.3.final) +43 more potentially affected by CVE-2023-0105 via org.keycloak:keycloak-core (1.9.3.final)

org.keycloak:keycloak-core MAVEN version 1.9.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.7.2 - org.keycloak:keycloak-adapter-core 1.9.3.fin...

io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.4.final, <=1.2.6.beta1), io.apiman:apiman-distro-eap7 (>=1.2.4.final, <=1.2.6.beta1) +48 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (1.9.2.final)

org.keycloak:keycloak-core MAVEN version 1.9.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman.plugins:apiman-plugins-keycloak-oauth-policy =1.2.4.final, =1.2.4.final, =1.2.4.final,...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (>=0.7.0, <=0.7.1), io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.2.final, <=1.2.3.final) +51 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (1.9.0.final)

org.keycloak:keycloak-core MAVEN version 1.9.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard =0.7.0, =1.2.2.final, =1.2.2.final, =1.2.2.final,...

io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=1.2.7.beta1, <=1.2.7.final), io.apiman:apiman-distro-eap7 (>=1.2.7.beta1, <=1.2.7.final) +49 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (1.9.7.final)

org.keycloak:keycloak-core MAVEN version 1.9.7.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman.plugins:apiman-plugins-keycloak-oauth-policy =1.2.7.beta1, =1.2.7.beta1, =1.2.7.beta1,...

org.hawkular.accounts:hawkular-accounts (>=2.0.23.final, <=2.0.39.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.23.final, <=2.0.39.final) +53 more potentially affected by CVE-2020-27838 via org.keycloak:keycloak-core (1.9.1.final)

org.keycloak:keycloak-core MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.23.final, =2.0.23.final, =2.0.23.final, =2.0.23.final,...

com.gitblit.fathom:fathom-security-keycloak (>=0.8.4, <=1.0.1), org.commonjava.indy.embed:indy-embedder (>=1.3.0, <=1.5.0.3) +54 more potentially affected by CVE-2020-10770 via org.keycloak:keycloak-core (1.9.8.final)

org.keycloak:keycloak-core MAVEN version 1.9.8.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.gitblit.fathom:fathom-security-keycloak =0.8.4, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0, =1.1.0,...