Most recent entries from all

EUVD-2026-278831

2026-10-03T03:29:33.126323+00:00

EUVD-2026-278831

fkie_cve-2026-1035

2026-10-03T03:29:33.126360+00:00

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined.

GHSA-m2w5-7xhv-w6fh — Keycloak does not validate and update refresh token usage atomically

2026-10-03T03:29:33.126396+00:00

Affected: Maven: org.keycloak:keycloak-services

jvndb-2026-026852

2026-10-03T03:29:33.126424+00:00

Multiple vulnerabilities exist in Hitachi Ops Center Common Services. CVE-2025-10939, CVE-2025-11537, CVE-2025-11538, CVE-2025-12110, CVE-2025-13467, CVE-2025-13881, CVE-2025-14082, CVE-2025-14083, CVE-2025-14777, CVE-2025-66560, CVE-2026-0707, CVE-2026-0871, CVE-2026-0976, CVE-2026-1035, CVE-2026-1190, CVE-2026-2092, CVE-2026-2575, CVE-2026-2673, CVE-2026-3009, CVE-2026-3121, CVE-2026-3429, CVE-2026-3872, CVE-2026-3911, CVE-2026-4282, CVE-2026-4325, CVE-2026-4634, CVE-2026-22745, CVE-2026-22748, CVE-2026-25854, CVE-2026-40972, CVE-2026-40975

RHSA-2026:6477 — Red Hat Security Advisory: Red Hat build of Keycloak 26.4.11 Update

2026-10-03T03:29:33.126445+00:00

keycloak-services: Keycloak Admin REST API: Improper Access Control leads to sensitive role metadata information disclosure keycloak-server: Keycloak: Improper Access Control in Admin REST API leads to information disclosure keycloak: Keycloak IDOR in realm client creating/deleting org.keycloak.protocol.oidc: Keycloak Refresh Token Reuse Bypass via TOCTOU Race Condition org.keycloak.protocol.oidc: Blind Server-Side Request Forgery (SSRF) in Keycloak OIDC Dynamic Client Registration via jwks_uri keycloak: Keycloak: Information disclosure via authorization bypass in Admin API keycloak: org.keycloak/keycloak-services: Keycloak: Privilege escalation via manage-clients permission keycloak: Keycloak: Information Disclosure via improper role enforcement in UMA 2.0 Protection API org.keycloak.services.resources.account: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API keycloak: Keycloak: Information disclosure due to redirect_uri validation bypass org.keycloak.services.resources.admin.UserResource: Keycloak: Information disclosure of disabled user attributes via administrative endpoint keycloak: Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw keycloak: Keycloak: Replay of action tokens via improper handling of single-use entries keycloak: Keycloak: Denial of Service via excessive processing of OpenID Connect scope parameters keycloak: Keycloak: UMA policy bypass allows authen…

UBUNTU-CVE-2026-1035

2026-10-03T03:29:33.126490+00:00

Affected: Ubuntu:24.04:LTS: python-keycloak, Ubuntu:25.10: python-keycloak

WID-SEC-W-2026-0197 — Keycloak: Mehrere Schwachstellen

2026-10-03T03:29:33.126513+00:00

Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.