CVE-2026-3429

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered...

org.jboss.errai:errai-security-demo (>=3.1.0.cr1, <=3.1.0.final), org.jboss.errai:errai-security-keycloak (>=3.1.0.cr1, <=3.1.0.final) +41 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (1.0-beta-2)

org.keycloak:keycloak-core MAVEN version 1.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.errai:errai-security-demo =3.1.0.cr1, =3.1.0.cr1, =3.1.0.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.beta2), org.jboss.aerogear.unifiedpush:unifiedpush-jaxrs (1.0.0.beta2) +49 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (1.0-beta-4)

org.keycloak:keycloak-core MAVEN version 1.0-beta-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.beta2 -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (>=0.2.1, <=0.3.0), org.keycloak:keycloak-account-api (1.5.0-final) +84 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (1.5.0-final)

org.keycloak:keycloak-core MAVEN version 1.5.0-final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard =0.2.1, =0.3.0 - org.keycloak:keycloak-account-api...

org.keycloak:keycloak-account-api (1.2.0.beta1), org.keycloak:keycloak-account-freemarker (1.2.0.beta1) +80 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (1.2.0.beta1)

org.keycloak:keycloak-core MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.2.0.beta1 - org.keycloak:keycloak-account-freemarker 1.2.0.beta1 ...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (>=0.2.1, <=0.3.0), org.keycloak:keycloak-account-api (1.5.0-final) +84 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (1.5.0-final)

org.keycloak:keycloak-core MAVEN version 1.5.0-final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard =0.2.1, =0.3.0 - org.keycloak:keycloak-account-api...

org.jboss.errai:errai-security-demo (>=3.1.0.cr1, <=3.1.0.final), org.jboss.errai:errai-security-keycloak (>=3.1.0.cr1, <=3.1.0.final) +41 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (1.0-beta-2)

org.keycloak:keycloak-core MAVEN version 1.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.errai:errai-security-demo =3.1.0.cr1, =3.1.0.cr1, =3.1.0.final -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.5.0), io.apiman:apiman-distro-wildfly9 (1.2.1.final) +88 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (1.7.0.final)

org.keycloak:keycloak-core MAVEN version 1.7.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.5.0 - io.apiman:apiman-distro-wildfly9 1.2.1.final...

org.keycloak:keycloak-account-api (1.0-beta-1-20150523), org.keycloak:keycloak-account-freemarker (1.0-beta-1-20150523) +36 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (1.0-beta-1-20150523)

org.keycloak:keycloak-core MAVEN version 1.0-beta-1-20150523 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0-beta-1-20150523 -...

org.hawkular.accounts:hawkular-accounts (>=2.0.20.final, <=2.0.22.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.20.final, <=2.0.22.final) +93 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (1.8.1.final)

org.keycloak:keycloak-core MAVEN version 1.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.20.final, =2.0.20.final, =2.0.20.final, =2.0.20.final,...

org.keycloak:keycloak-account-api (1.5.1.final), org.keycloak:keycloak-account-freemarker (1.5.1.final) +89 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (1.5.1.final)

org.keycloak:keycloak-core MAVEN version 1.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.5.1.final - org.keycloak:keycloak-account-freemarker 1.5.1.final ...

org.keycloak:keycloak-account-api (1.0-beta-1), org.keycloak:keycloak-account-freemarker (1.0-beta-1) +38 more potentially affected by CVE-2023-6841 via org.keycloak:keycloak-core (1.0-beta-1)

org.keycloak:keycloak-core MAVEN version 1.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0-beta-1 - org.keycloak:keycloak-account-freemarker 1.0-beta-1 -...

io.apiman:apiman-distro-wildfly8 (>=1.0.0.beta2, <=1.0.0.final), io.apiman:apiman-manager-ui-war-wildfly8 (>=1.0.0.beta2, <=1.0.2.final) +71 more potentially affected by CVE-2023-6841 via org.keycloak:keycloak-core (1.1.0.beta2)

org.keycloak:keycloak-core MAVEN version 1.1.0.beta2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman:apiman-distro-wildfly8 =1.0.0.beta2, =1.0.0.beta2, =1.0.0.beta2, =2.0.16, =2.0.20, =2.2.28 ...

org.hawkular.accounts:hawkular-accounts (>=2.0.14.final, <=2.0.17.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.14.final, <=2.0.17.final) +91 more potentially affected by CVE-2023-6841 via org.keycloak:keycloak-core (1.8.0.cr3)

org.keycloak:keycloak-core MAVEN version 1.8.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.14.final, =2.0.14.final, =2.0.14.final, =2.0.14.final,...

org.hawkular.accounts:hawkular-accounts (>=2.0.7.final, <=2.0.10.final), org.hawkular.accounts:hawkular-accounts-api (>=2.0.7.final, <=2.0.10.final) +91 more potentially affected by CVE-2023-6841 via org.keycloak:keycloak-core (1.8.0.alpha1)

org.keycloak:keycloak-core MAVEN version 1.8.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.hawkular.accounts:hawkular-accounts =2.0.7.final, =2.0.7.final, =2.0.7.final, =2.0.7.final,...

org.keycloak:keycloak-account-api (1.0-rc-2), org.keycloak:keycloak-account-freemarker (1.0-rc-2) +48 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (1.0-rc-2)

org.keycloak:keycloak-core MAVEN version 1.0-rc-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0-rc-2 - org.keycloak:keycloak-account-freemarker 1.0-rc-2 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.final), org.jboss.aerogear.unifiedpush:unifiedpush-jaxrs (1.0.0.final) +50 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (1.0-rc-1)

org.keycloak:keycloak-core MAVEN version 1.0-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.final -...

org.keycloak:keycloak-account-api (1.0.2.final), org.keycloak:keycloak-account-freemarker (1.0.2.final) +48 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (1.0.2.final)

org.keycloak:keycloak-core MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0.2.final - org.keycloak:keycloak-account-freemarker 1.0.2.final ...

org.keycloak:keycloak-account-api (1.0.1.final), org.keycloak:keycloak-account-freemarker (1.0.1.final) +48 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (1.0.1.final)

org.keycloak:keycloak-core MAVEN version 1.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0.1.final - org.keycloak:keycloak-account-freemarker 1.0.1.final ...

org.keycloak:keycloak-account-api (1.4.0.final), org.keycloak:keycloak-account-freemarker (1.4.0.final) +94 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (1.4.0.final)

org.keycloak:keycloak-core MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.4.0.final - org.keycloak:keycloak-account-freemarker 1.4.0.final ...