https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T07:03:50.060484+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-keycloak-2026-16100 BIT-keycloak-2026-16100 — Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error t… 2026-10-03T07:03:50.145160+00:00

Affected: Bitnami: keycloak

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0976 certfr-2026-avi-0976 — De multiples vulnérabilités ont été découvertes dans KeyCloak. Certaines d'entre elles permettent à un attaquant de pro… 2026-10-03T07:03:50.145240+00:00 certfr-2026-avi-0976 https://cve.radiocsirt.org/vuln/euvd-2026-361840 EUVD-2026-361840 2026-10-03T07:03:50.145269+00:00 EUVD-2026-361840 https://cve.radiocsirt.org/vuln/fkie_cve-2026-16100 fkie_cve-2026-16100 2026-10-03T07:03:50.145289+00:00

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

 https://cve.radiocsirt.org/vuln/ghsa-xj3w-m54w-h7p9 GHSA-xj3w-m54w-h7p9 2026-10-03T07:03:50.145336+00:00

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

 https://cve.radiocsirt.org/vuln/rhsa-2026:50848 RHSA-2026:50848 — Red Hat Security Advisory: Red Hat build of Keycloak 26.6.5 Security Update 2026-10-03T07:03:50.145366+00:00

keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604 keycloak: Keycloak: Security policy bypass in JWE-encrypted request object processing keycloak: Keycloak: Brute-force protection bypass in CIBA flow keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak keycloak-admin-ui: keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions keycloak-services: keycloak-services: FGAP v2 client scope assignment bypass via ClientResource keycloak-services: keycloak: FGAP v2 parent group children endpoint bypasses per-child view permission filter keycloak-services: keycloak-services: DCR protocol mapper type-swap policy bypass allows privilege escalation keycloak-services: keycloak-services: Authorization bypass via unnormalized URI matching in PathMatcher keycloak-services: keycloak-services: LDAP entry-DN user search bypasses configured users DN boundary keycloak-services: keycloak-services: Unbounded metric cardinality in user event metrics via request-controlled error text keycloak-services: keycloak-services: Default DCR policy allows role forgery via User Property mappers io.quarkus/quarkus-rest: io.quarkus/quarkus-vertx-http: io.quarkus.resteasy.reactive/resteasy-reactive: Quarkus REST - Unbounded multipart MIME part-header accumulation allows remote OOM denial of service keycloak-serv…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2677 WID-SEC-W-2026-2677 — RedHat Build of Keycloak: Mehrere Schwachstellen 2026-10-03T07:03:50.145470+00:00

Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Administratorrechte zu erlangen, Benutzerkonten zu übernehmen, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, Daten zu manipulieren oder einen Denial-of-Service-Zustand herbeizuführen.