GHSA-P845-629J-RCJ6 New API: Admin can reset passkeys for same-level or higher-privileged users

Summary The admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints. A lower-privileged administrator could attempt passkey reset operations against same-level or higher-privileged users, including root-level accounts. Impa...

KeyCloak - Information Exposure

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients like client secret without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this...

Keycloak - SAML Core Package Signature Validation Flaw

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...

Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting

Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response i...

Keycloak - Open Redirect

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)

Keycloak 12.0.1 and below allows an attacker to force the server to request an unverified URL using the OIDC parameter requesturi. This allows an attacker to execute a server-side request forgery SSRF attack. id: CVE-2020-10770 info: name: Keycloak = 12.0.1 - requesturi Blind Server-Side Request...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-route53-fips, crossplane-provider-aws-ecr-fips, datadog-agent, crossplane-provider-aws-cloudformation, crossplane-provider-family-azure, elastic-agent, tempo, crossplane-provider-aws-kinesis-fips, crossplane-provider-aws-kms,...

CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

CLEANSTART-2026-YY19713 Security fixes in keycloak 26.7.0-r1

Package keycloak version 26.7.0-r1 fixes 13 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

CLEANSTART-2026-WD74020 Security fixes in keycloak 26.6.4-r1

Package keycloak version 26.6.4-r1 fixes 14 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

Insufficient Session Expiration

Apache Camel Keycloak Component is vulnerable to Insufficient Session Expiration. The vulnerability is due to KeycloakSecurityHelper.parseAndVerifyAccessToken omitting the TokenVerifier.ISACTIVE check, allowing expired or not-yet-valid access tokens to pass signature, subject, and issuer validati...

CVE-2026-68971

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-40984 vulnerabilities

Vulnerabilities for packages: ontop, airbyte-server, apicurio-registry, infinispan, dependency-track, kafka-bridge-fips, apache-nifi, ontop-fips, nacos-docker, apicurio-registry-fips, zipkin, nacos, airbyte-server-fips, keycloak, keycloak-fips, dependency-track-apiserver,...

GHSA-G3PR-3P32-FP23 vulnerabilities

Vulnerabilities for packages: ontop, airbyte-server, apicurio-registry, infinispan, dependency-track, kafka-bridge-fips, apache-nifi, ontop-fips, nacos-docker, apicurio-registry-fips, zipkin, nacos, airbyte-server-fips, keycloak, keycloak-fips, dependency-track-apiserver,...

CVE-2026-40983 vulnerabilities

Vulnerabilities for packages: airbyte-server, apicurio-registry, infinispan, dependency-track, apache-nifi, nacos-docker, apicurio-registry-fips, zipkin, nacos, airbyte-server-fips, keycloak, keycloak-fips, dependency-track-apiserver, request-9047-keycloak-fips, camunda-zeebe...

GHSA-W737-WX49-QJ23 vulnerabilities

Vulnerabilities for packages: airbyte-server, apicurio-registry, infinispan, dependency-track, apache-nifi, nacos-docker, apicurio-registry-fips, zipkin, nacos, airbyte-server-fips, keycloak, keycloak-fips, dependency-track-apiserver, request-9047-keycloak-fips, camunda-zeebe...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

EUVD-2026-53716

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...