wildfly-elytron-realm-token: parameter injection in EAP's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

kerberoast

🚩 Sponsors If you like this project, consider sponsoring it on GitHub! Sponsors kerberoast Kerberos attack toolkit -pure python- Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos are th...

certbot

.. This file contains a series of comments that are used to include sections of this README in other files. Do not modify these comments unless you know what you are doing. tag:intro-begin |build-status| .. |build-status| image::...

paragon

非推奨のお知らせ このプロジェクトは非推奨となりました。新しい Realm プロジェクト を参照してください。このリポジトリを構築した際の多くのアイデアを基にしています。 Paragon Paragon はレッドチームエンゲージメントプラットフォームです。シンプルな UI の背後で攻撃ツールを統合し、バックエンド作業の多くを抽象化することで、オペレーターはインプラントの作成に集中でき、データベースや CSS に悩む時間を減らすことができます。このリポジトリには、エンゲージメント中に使用できる Paragon に統合された攻撃ツールもいくつか含まれています。...

CVE-2026-18963_analyst

...

CVE-2026-27495

CVE-2026-27495 — n8n JS Task Runner サンドボックスエスケープ ホストレルムのオブジェクトリークを通じた n8n JavaScript Task Runner のサンドボックスエスケープ。...

CVE-2026-94215

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-94215 Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-94215

Keycloak's Admin REST API contains a cross-realm privilege escalation flaw. The API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying realm ownership , allowing a limited-privilege administrator to read or modify client configurations in the master...

EUVD-2026-83841

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm specified in the reque...

CVE-2026-94000

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

EUVD-2026-83601

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CVE-2026-94000

A flaw in the Admin REST API of Keycloak (open-source identity and access management) exists in the group-membership endpoints . The system fails to check whether a group grants administrative privileges before allowing a user to be added to it. This allows a delegated administrator holding the m...

CVE-2026-94000 Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CVE-2026-94000

A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated...

CLEANSTART-2026-ZE25949 flaw was found in the default-groups REST endpoint and realm representation of Keycloak

Security vulnerability affects the keycloak package. A flaw was found in the default-groups REST endpoint and realm representation of Keycloak...

CVE-2026-85511

A parameter injection flaw was identified in Red Hat EAP's Elytron security subsystem. Specifically, an EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection allows parameter substitution due to missing URL encoding . The vulnerability is rated MEDIUM...

CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

EUVD-2026-82946

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-85511 Wildfly-elytron-realm-token: parameter injection in eap's elytron oauth2

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...