CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

CVE-2026-1529 Keycloak Exploit Tool Keycloak: 不適切な招待トークン検証による未承認の組織登録 免責事項 このツールは教育およびセキュリティテスト目的のみで使用してください。 明示的なテスト許可を得たシステムでのみ使用してください。コンピュータシステムへの不正アクセスは違法かつ非倫理的です。本ツールの作成者は、本ソフトウェアの誤用や損害について一切の責任を負いません。 作成者: f3ds cr3w est, 2002 概要 CVE-2026-1529 は Keycloak...

CVE-2026-1529-PoC-keycloak-unauthorized-registration-via-improper-invitation-token-validation

CVE-2026-1529 Keycloak エクスプロイトツール Keycloak: 不適切な招待トークン検証による未承認の組織登録 免責事項 このツールは教育およびセキュリティテスト目的のみで使用してください。 明示的なテスト許可を得たシステムでのみ使用してください。コンピュータシステムへの不正アクセスは違法かつ非倫理的です。このツールの作者は、本ソフトウェアによって引き起こされた誤用や損害について一切の責任を負いません。 作成者: f3ds cr3w est, 2002 概要 CVE-2026-1529 は Keycloak...

CVE-2026-1529

CVE-2026-1529 Keycloak エクスプロイトツール CVE-2026-1529 : Keycloak - 不適切な招待トークン検証による未承認の組織登録 ⚠️ 警告 : このツールは教育目的および許可されたセキュリティテスト専用です。コンピュータシステムへの不正アクセスは違法です。 📋 目次 概要 機能 前提条件 インストール 使用方法 設定 動作原理 出力 トラブルシューティング 法的免責事項 貢献 クレジット 🎯 概要...

CVE-2024-32444

CVE-2024-32444 2025年1月24日時点で、この脆弱性にはパッチが存在しないため、これは単なる製品検出テンプレートです。RealHome WordPressテーマに関連するすべての製品が影響を受けます。 このテーマでは、inspiryajaxregister 関数を介してユーザーが新しいアカウントを登録できますが、認可チェックが適切に行われず、nonce検証も実装されていません。...

EUVD-2026-82688

The Clean Login WordPress plugin before 1.19 does not check whether user registration is enabled before creating an account in its registration handler, allowing unauthenticated users to create accounts even when the site has registration disabled...

SAP NetWeaver Missing Authentication (3759472)

The version of the SAP NetWeaver kernel detected on the remote host is affected by a missing authentication vulnerability as referenced in SAP Security Note 3759472: - SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during...

CVE-2026-58240

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially...

CVE-2026-18207

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a...

CVE-2026-11802 FoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action

The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration function, accessible via the wpajaxnoprivregistrationaction AJAX action, lacks any nonce verification or capability check, and...

CVE-2026-11802

The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The registration function, accessible via the wpajaxnoprivregistrationaction AJAX action, lacks any nonce verification or capability check, and...

CVE-2026-44443 Lumiverse: Sign-up nonce race condition allows unauthorized account registration

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, consumeNonce only checks that the module-level variable is set and unexpired. It does not validate any value from the incoming HTTP request or bind the nonce to the admin's session. If the admin's auth.api.signUpEmail call fails...

Chamilo LMS 安全漏洞

Chamilo LMS is an open-source online learning and collaboration system developed by Chamilo. This system supports the creation of teaching content, remote training, and online quizzes. Versions of Chamilo LMS prior to 2.0.0-RC.3 contained security vulnerabilities. These vulnerabilities stemmed fr...

EUVD-2026-14012

The App Builder – Create Native Android & iOS Apps On The Flight plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.5.10. This is due to the verifyrole function in AuthTrails.php explicitly whitelisting the wcfmvendor role alongside subscriber and...

EUVD-2025-208135

A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.13 Images Security Update

New images are available for Red Hat build of Keycloak 26.2.13 and Red Hat build of Keycloak 26.2.13 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.13 Security Update

New Red Hat build of Keycloak 26.2.13 packages are available from the Customer Portal Red Hat build of Keycloak 26.2.13 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

CVE-2026-1529

CVE-2026-1529 affects Keycloak. An attacker can craft/modify a legitimate invitation token’s JWT payload to change the organization ID and target email, exploiting a lack of cryptographic signature verification to self-register into an unauthorized organization and gain access. The vulnerability ...

CVE-2023-4278

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.0.18 does not have proper checks in place during registration allowing anyone to register on the site as an instructor. They can then add courses and/or posts...

Primakon Pi Portal 安全漏洞

Primakon Pi Portal is a project, contract management platform from Primakon Croatia. A security vulnerability exists in Primakon Pi Portal version 1.0.18, which stems from a lack of authorization checking in the /api/v2/user/register endpoint, which could lead to unauthorized user registration...

WordPress WPFunnels plugin unauthorized user registration vulnerability

WordPress WPFunnels plugin is a funnel builder designed for WordPress and WooCommerce. WordPress WPFunnels plugin suffers from an unauthorized user registration vulnerability that stems from relying on the user control value optinallowregistration to determine user registration permissions, which...