Most recent entries from all

EUVD-2026-246194

2026-10-08T19:27:20.230178+00:00

EUVD-2026-246194

fkie_cve-2020-35509

2026-10-08T19:27:20.230211+00:00

A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.

GHSA-rpj2-w6fr-79hc — Keycloak vulnerable to Improper Certificate Validation

2026-10-08T19:27:20.230240+00:00

Affected: Maven: org.keycloak:keycloak-core

keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.

This issue was partially fixed in version [13.0.1](https://github.com/keycloak/keycloak/pull/6330) and more completely fixed in version [14.0.0](https://github.com/keycloak/keycloak/pull/8067).

gsd-2020-35509

2026-10-08T19:27:20.230265+00:00

gsd-2020-35509

RHSA-2021:3527 — Red Hat Security Advisory: Red Hat Single Sign-On 7.4.9 security update on RHEL 6

2026-10-08T19:27:20.230277+00:00

jackson-dataformat-cbor: Unchecked allocation of byte buffer can cause a java.lang.OutOfMemoryError exception keycloak: X509 Direct Grant Auth does not verify certificate timestamp validity keycloak: Brute force attack is possible even after the account lockout keycloak: Anyone can register a new device when there is no device registered for passwordless login keycloak-model-infinispan: authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly could lead to a DoS attack