CVE-2026-18214 Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This mean...

CVE-2026-18214

Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This mean...

CVE-2026-18208

Affected product: Keycloak (keycloak-services OIDC token introspection endpoint). Issue: when a confidential client that expects signed JWT introspection responses inspects a token issued for a different audience, the endpoint still returns the full set of token claims inside a signed JWT field e...

EUVD-2026-51482

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

CVE-2026-18208 Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

CVE-2026-18208

A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT...

EUVD-2026-51480

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...

CVE-2026-18215

Keycloak-security issue: Microsoft accounts login with tenant restriction can be bypassed via token exchange. A valid Microsoft token from a different organization could grant access to the Keycloak realm, exposing data or enabling unauthorized actions. Affected component is Keycloak’s Microsoft ...

CVE-2026-18215 Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...

CVE-2026-18215

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...

CVE-2026-18215

Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization tenant. A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely...

EUVD-2026-51478

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

CVE-2026-18218

The vulnerability CVE-2026-18218 affects Keycloak’s TokenManager component. When an administrator revokes tokens for a specific client under a not-before policy, revocation can be silently ignored if the realm’s overall not-before policy is older but non-zero. As a result, previously issued token...

CVE-2026-18218

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

CVE-2026-18218 Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

CVE-2026-56672

ComfyUI is a node-based diffusion model GUI, API, and backend. Prior to 0.28.0, GET /userdata/file served user-controlled HTML and SVG files with extension-derived content types, allowing stored cross-site scripting in the ComfyUI origin and access to browser-stored API tokens, settings, workflow...

CVE-2026-55502

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, POST /api/v4/admin/policy/oauth/signin requires only Admin.Read even though GetOauthRedirectService persists caller-supplied OneDrive secret and appid values, allowing an OAuth token without Admin.Write to modify...

CVE-2026-62323 Cloudreve: Unauthorized file write via WOPI view sessions whose access token secret is ignored

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token...

EUVD-2026-51395

Cloudreve is a self-hosted file management and sharing system. Prior to 4.17.0, ViewerSessionValidation uses only the session-id prefix of a WOPI access token and does not enforce the requested viewer action, allowing a malicious or compromised WOPI viewer with a view session to forge the token...

CVE-2026-62323

CVE-2026-62323 affects Cloudreve prior to 4.17.0 where WOPI viewer sessions can bypass token suffix validation. The WOPI middleware only checks the session ID prefix and does not compare the full access_token to the stored token, allowing a forged suffix to authorize read and, crucially, write op...