GHSA-P845-629J-RCJ6 New API: Admin can reset passkeys for same-level or higher-privileged users

Summary The admin passkey reset endpoint lacked the role-level authorization check used by comparable privileged account-protection endpoints. A lower-privileged administrator could attempt passkey reset operations against same-level or higher-privileged users, including root-level accounts. Impa...

Weak Password Recovery Mechanism for Forgotten Password

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password in the ResetCredentialEmail.action flow in...

GO-2026-4526 vulnerabilities

Vulnerabilities for packages: crossplane-provider-gcp, crossplane-provider-aws-kinesis, crossplane-provider-aws-lambda, crossplane-provider-aws-rolesanywhere, crossplane-provider-aws-ecs-fips, crossplane-provider-aws-cognitoidp-fips, crossplane-provider-aws-sqs, crossplane-provider-aws-ssm-fips,...

CVE-2026-55987 OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens incomplete fix of 38009...

CLEANSTART-2026-IB33850 Security fixes in crossplane-provider-keycloak-fips 2.21.1-r1

Package crossplane-provider-keycloak-fips version 2.21.1-r1 fixes 2 vulnerabilities: CVE-2026-41178, ghsa-jpcw-4wr7-c3vq...

CLEANSTART-2026-WD74020 Security fixes in keycloak 26.6.4-r1

Package keycloak version 26.6.4-r1 fixes 14 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

CLEANSTART-2026-FB06164 Security fixes in crossplane-provider-keycloak-fips 2.22.1-r1

Package crossplane-provider-keycloak-fips version 2.22.1-r1 fixes 3 vulnerabilities: CVE-2026-27145, CVE-2026-42504, CVE-2026-42507...

CLEANSTART-2026-YY19713 Security fixes in keycloak 26.7.0-r1

Package keycloak version 26.7.0-r1 fixes 13 vulnerabilities: ghsa-rmj7-2vxq-3g9f, ghsa-j3rv-43j4-c7qm, ghsa-9fxm-vc8v-hj55, ghsa-5hh8-q8hv-fr38, ghsa-rcqc-6cw3-h962...

CLEANSTART-2026-ZA01366 Security fixes in crossplane-provider-keycloak 2.22.1-r2

Package crossplane-provider-keycloak version 2.22.1-r2 fixes 2 vulnerabilities: CVE-2026-56852, CVE-2026-5160...

Insufficient Session Expiration

Apache Camel Keycloak Component is vulnerable to Insufficient Session Expiration. The vulnerability is due to KeycloakSecurityHelper.parseAndVerifyAccessToken omitting the TokenVerifier.ISACTIVE check, allowing expired or not-yet-valid access tokens to pass signature, subject, and issuer validati...

CVE-2026-68971

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-68971 Apache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints

Apache Airflow's asset materialization endpoint POST /api/v2/assets/assetid/materialize and the XCom result check on waitdagrununtilfinished authorized the target Dag without its team, unlike every other authorization site. A team-aware auth manager distinguishes a team-scoped Dag from a global o...

CVE-2026-40984 vulnerabilities

Vulnerabilities for packages: apache-nifi, ontop-fips, airbyte-server, keycloak-fips, nacos, request-9047-keycloak-fips, apicurio-registry, apicurio-registry-fips, zipkin, ontop, knative-kafka-broker-fips, dependency-track-apiserver, dependency-track, nacos-docker, kafka-bridge-fips,...

CVE-2026-40983 vulnerabilities

Vulnerabilities for packages: airbyte-server-fips, camunda-zeebe, apache-nifi, dependency-track-apiserver, dependency-track, apicurio-registry-fips, airbyte-server, keycloak, nacos-docker, keycloak-fips, zipkin, infinispan, nacos, request-9047-keycloak-fips, apicurio-registry...

GHSA-G3PR-3P32-FP23 vulnerabilities

Vulnerabilities for packages: apache-nifi, ontop-fips, airbyte-server, keycloak-fips, nacos, request-9047-keycloak-fips, apicurio-registry, apicurio-registry-fips, zipkin, ontop, knative-kafka-broker-fips, dependency-track-apiserver, dependency-track, nacos-docker, kafka-bridge-fips,...

GHSA-W737-WX49-QJ23 vulnerabilities

Vulnerabilities for packages: airbyte-server-fips, camunda-zeebe, apache-nifi, dependency-track-apiserver, dependency-track, apicurio-registry-fips, airbyte-server, keycloak, nacos-docker, keycloak-fips, zipkin, infinispan, nacos, request-9047-keycloak-fips, apicurio-registry...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

CVE-2026-18967

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

EUVD-2026-53716

A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused asserti...

CVE-2026-18967

The CVE affects Keycloak’s SAML broker component when configured as an IdP-Initiated flow. The vulnerability arises because OneTimeUse in SAML assertions is not enforced, allowing an attacker who captures a valid, unused assertion to replay it and potentially hijack a user’s session, granting una...