PT-2026-66727

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description Keycloak allows authentication via Google accounts and can be restricted to specific Google Workspace domains. A flaw exists in the token exchange feature, which enables the swapping of a...

PT-2026-66721

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the RoleContainerResource component of Keycloak. Certain name-based endpoints in the admin REST API fail to properly enforce authorization checks during the management of...

PT-2026-66728

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description Keycloak allows users to authenticate using Microsoft accounts with restrictions limited to a specific organization tenant. A flaw exists where this tenant restriction is ignored during the...

PT-2026-66726

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the...

PT-2026-66722

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the group policy evaluation logic of Keycloak. When a group policy is configured to extend permissions to child groups, the system employs a simple text-based prefix check t...

PT-2026-66870

Name of the Vulnerable Software and Affected Versions GeoNetwork versions 3.12.0 through 4.2.15 GeoNetwork versions 4.4.0 through 4.4.10 Description Unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter allows an attacker to redirect...

PT-2026-66730

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization due to the full-scope-disabled client-policy executor. An attacker can create a client...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-18570 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18570 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752067...

Missing Authorization

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and...

Incorrect Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Authorization due to claim handling in the UMA claim-token evaluation path. An attacker can access...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-18573 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-18573 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752054...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization during client update handling. An attacker can persist a confidential client that does...

CLEANSTART-2026-WW01909 Security fixes in keycloak 26.3.5-r3

Package keycloak version 26.3.5-r3 fixes 24 vulnerabilities: CVE-2026-42583, CVE-2026-42579, CVE-2026-44893, CVE-2026-48059, CVE-2026-33870...

CLEANSTART-2026-LC38113 Security fixes in keycloak 26.4.7-r5

Package keycloak version 26.4.7-r5 fixes 5 vulnerabilities: CVE-2026-57914, CVE-2026-9563, CVE-2025-11965, CVE-2025-11966, CVE-2026-45536...

CLEANSTART-2026-QU85101 Security fixes in keycloak 26.4.11-r0

Package keycloak version 26.4.11-r0 fixes 4 vulnerabilities: CVE-2026-1002, CVE-2026-33871, ghsa-cphf-4846-3xx9, ghsa-w9fj-cfpg-grvv...

CLEANSTART-2026-QW10501 Security fixes in keycloak 26.4.10-r0

Package keycloak version 26.4.10-r0 fixes 26 vulnerabilities: CVE-2026-42579, CVE-2026-42587, CVE-2026-42583, CVE-2026-42584, CVE-2026-33871...

CLEANSTART-2026-SU06112 Security fixes in keycloak 26.6.3-r3

Package keycloak version 26.6.3-r3 fixes 13 vulnerabilities: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516...

CLEANSTART-2026-SH90347 Security fixes in keycloak 26.6.1-r3

Package keycloak version 26.6.1-r3 fixes 8 vulnerabilities: ghsa-3qp7-7mw8-wx86, ghsa-x4gw-5cx5-pgmh, ghsa-5x3r-wrvg-rp6q, ghsa-c2gf-v879-257j, CVE-2026-47244...