4781 matches found
CVE-2026-79652
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
CVE-2026-79652 Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
EUVD-2026-65465
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
CVE-2026-79652
A flaw in the JWT Bearer authorization grant within the keycloak-services component of Red Hat Build of Keycloak fails to verify whether a client requires user consent before issuing an access token. An authenticated attacker with valid client credentials and a trusted identity provider assertion...
CVE-2026-79652
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to...
BIT-KEYCLOAK-2026-18963 Flaw in the reset-credentials flow of the keycloak-services component
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
BIT-KEYCLOAK-2026-15571 Flaw in the legacy client-initiated account-linking endpoint of Keycloak
A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC...
CVE-2021-20323
CVE-2021-20323 Scanner di exploit per la vulnerabilità Cross Site Scripting in Keycloak...
CVE-2026-18963_analyst
Laboratorio Docker Keycloak CVE-2026-18963 Questo laboratorio avvia la versione vulnerabile di Keycloak 26.7.1 su localhost e inizializza un realm minimale per riprodurre il flusso della CVE. Documenti di indagine Analisi del flusso di lavoro: causa root a livello di sorgente, sequenza delle...
Exploit for CVE-2026-18963
CVE-2026-18963 — Lab tái dựng lại Keycloak reset-credentials...
VulnCheck KEV: CVE-2026-18963
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the...
Exploit for CVE-2026-18963
CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account T...
keycloak-cve-2026-18963-hunt
CVE-2026-18963: Keycloak account takeover, caccia alle tracce di sfruttamento Uno script psql che cerca in un database PostgreSQL di Keycloak le tracce dello sfruttamento di CVE-2026-18963 account takeover non autenticato tramite il flusso reset-credentials. Pubblicato da KYOS. Lo abbiamo scritto...
CVE-2025-68833
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources...
EUVD-2025-210762
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources...
CVE-2025-68833 HCL Hive is affected by use of a cryptographic primitive with a risky implementation
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control which could allow an attacker unauthorized access to resources...
CVE-2025-68833
HCL Hive Keycloak IAM Instance is affected by insufficient granularity of access control , which could allow an unauthenticated, remote attacker to gain unauthorized access to resources . The CVSS 3.1 score is 5.3 (Medium) , reflecting a network attack vector with low complexity, no privileges or...
Exploit for CVE-2026-18963
POC-CVE-20...
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Red Hat and the Keycloak project have released patches to address a critical security flaw in the open-source identity and access management server that could allow an unauthenticated remote attacker to take over any user account by forcing a password reset. The vulnerability, assigned the CVE...
