Most recent entries from all

bdu:2024-04782

2026-10-08T05:54:15.638909+00:00

bdu:2024-04782

EUVD-2026-261407

2026-10-08T05:54:15.638942+00:00

EUVD-2026-261407

fkie_cve-2024-3656

2026-10-08T05:54:15.638956+00:00

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.

GHSA-2cww-fgmg-4jqc — Keycloak's admin API allows low privilege users to use administrative functions

2026-10-08T05:54:15.638984+00:00

Affected: Maven: org.keycloak:keycloak-services

Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.

**Acknowledgements:** Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.

gsd-2024-3656

2026-10-08T05:54:15.639009+00:00

gsd-2024-3656

RHSA-2024:3572 — Red Hat Security Advisory: Red Hat Single Sign-On 7.6.9 security update

2026-10-08T05:54:15.639020+00:00

keycloak: Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities keycloak: exposure of sensitive information in Pushed Authorization Requests (PAR) KC_RESTART cookie

WID-SEC-W-2024-1350 — Keycloak: Schwachstelle ermöglicht Erlangen von Administratorrechten

2026-10-08T05:54:15.639037+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Administratorrechte zu erlangen.