2193 matches found
CVE-2026-93999
Keycloak's OIDC token refresh process contains a flaw where the server restores requested audiences from stored client IDs but fails to verify whether the target audience client is still enabled before issuing a new access token. This allows an application holding an existing refresh token to con...
CVE-2026-93999 Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...
EUVD-2026-83600
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...
CVE-2026-93999
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...
PT-2026-95825
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the OpenID Connect OIDC protocol implementation. During the token refresh process, the server restores requested audiences from stored client IDs but fails to verify if the...
CVE-2026-93999: Missing Authorization
A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client i...
keycloak-services: keycloak-services: Client not-before revocation ignored when realm not-before is older but nonzero
A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...
EUVD-2026-80323
Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...
CVE-2026-81921
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...
EUVD-2026-79287
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...
CVE-2026-81921
Concrete CMS versions 8.5.3 through 9.5.2 are affected by an OAuth 2.0 refresh-token grant flaw. The unmodified upstream League grant issued new access tokens from a valid refresh token without re-checking the associated account's active status . Consequently, a user who obtained a refresh token ...
CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...
CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...
CVE-2026-81921 In Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...
PT-2026-92392
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...
CVE-2026-81921: Missing Authorization
Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a valid refresh token without re-checking the associated account's active status. A user who obtained a refresh token while active could...
CVE-2026-88819
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...
EUVD-2026-77577
In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID...