CVE-2026-92358 Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

CVE-2026-57886

Cross-repository issue/comment attachment re-linking can expose private attachment content...

EUVD-2026-58147

Cross-repository issue/comment attachment re-linking can expose private attachment content...

CVE-2026-57886: Authorization Bypass Through User-Controlled Key

Cross-repository issue/comment attachment re-linking can expose private attachment content...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the attachment update. An attacker can access private attachment content by re-linking a known attachment UUID to an issue or comment in a repository they control, causing authorization checks to be performed...