https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T01:41:16.672912+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-05657 bdu:2023-05657 2026-10-03T01:41:16.809778+00:00 bdu:2023-05657 https://cve.radiocsirt.org/vuln/euvd-2026-6968 EUVD-2026-6968 2026-10-03T01:41:16.809820+00:00 EUVD-2026-6968 https://cve.radiocsirt.org/vuln/fkie_cve-2023-2585 fkie_cve-2023-2585 2026-10-03T01:41:16.809835+00:00

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.

 https://cve.radiocsirt.org/vuln/ghsa-f5h4-wmp5-xhg6 GHSA-f5h4-wmp5-xhg6 — Client Spoofing within the Keycloak Device Authorisation Grant 2026-10-03T01:41:16.809866+00:00

Affected: Maven: org.keycloak:keycloak-services, Maven: org.keycloak:keycloak-server-spi-private

Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.

 https://cve.radiocsirt.org/vuln/gsd-2023-2585 gsd-2023-2585 2026-10-03T01:41:16.809893+00:00 gsd-2023-2585 https://cve.radiocsirt.org/vuln/rhsa-2023:3883 RHSA-2023:3883 — Red Hat Security Advisory: Red Hat Single Sign-On 7.6.4 security update on RHEL 7 2026-10-03T01:41:16.809906+00:00

RHSSO: XSS due to lax URI scheme validation Undertow: Infinite loop in SslConduit during close keycloak: Untrusted Certificate Validation keycloak: oauth client impersonation keycloak: client access via device auth request spoof

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1573 WID-SEC-W-2023-1573 — Keycloak: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen 2026-10-03T01:41:16.809930+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak und Red Hat Single Sign On ausnutzen, um Sicherheitsvorkehrungen zu umgehen.