CVE-2026-16089 Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

EUVD-2026-45176

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

CVE-2026-16072

CVE-2026-16072 affects Keycloak’s organization management component. A delegated administrator with org-management permissions can create an invitation for a non-existent email address and then fetch the secret registration link via the API, enabling creation of new user accounts and their additi...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-16089 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-16089 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18612534...

CVE-2026-15943 Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

CVE-2026-15943

A vulnerability in Keycloak's keycloak-services component affects identity provider management. When a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value, the system performs improper validation and reuses the existing real secret even if fields ...

CVE-2026-62764

CVE-2026-62764 affects Apache Accumulo 2.1.4 and 2.1.5. An authenticated, low-privilege user without system permissions can remotely issue a command to gracefully shutdown several components (e.g., compaction-coordinator, compactor, gc, manager, monitor, tserver, or sserver), causing a denial of ...

[SECURITY] Fedora 44 Update: rust-opendal-0.55.0-2.fc44

OpenDAL is an Open Data Access Layer that enables seamless interaction with diverse storage services...

CVE-2026-62234

Grav 2.x prior to 2.0.4 contains an SSRF vulnerability in webhook dispatch where authenticated users with api.webhooks.write can create webhooks using file://, dict://, or gopher:// protocols. This unrestricted protocol handling can be leveraged to read local files, access process information, or...

PT-2026-60800

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw in the authentication configuration endpoint of the keycloak-services component allows the exposure of sensitive configuration values. The system fails to mask data,...

PT-2026-60799

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the keycloak-services component. The issue stems from an incomplete implementation of brute-force protection within the Client-Initiated Backchannel Authentication CIBA flow...

PT-2026-60770

A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes are not properly bound to the client that originally requested them. An attacker who can intercept an authorization code can modify it to be redeemed by their o...

PT-2026-60853

Name of the Vulnerable Software and Affected Versions Xenforo version 2.3.8 Description A Server-Side Request Forgery SSRF issue exists where users with administrator privileges or the ability to add and save RSS feeds can enumerate internal services and ports or expose the server's original IP...

CVE-2026-51833

Xenforo 2.3.8 is vulnerable to SSRF. Attackers that have administrator privileges or are able to add/save RSS feeds can enumerate internal services ports or expose the original IP address of the server...

CVE-2026-15945 Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-16072 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-16072 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18602952...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-16093 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-16093 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752079...

Reliance on Untrusted Inputs in a Security Decision

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the client authentication flow in the client...

Access Control Bypass

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Access Control Bypass through the Client-Initiated Backchannel Authentication token redemption handler in the...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +231 more potentially affected by CVE-2026-16103 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.1)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-16103 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752081...