https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:40:33.294169+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bit-keycloak-2026-17048 BIT-keycloak-2026-17048 — Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api 2026-10-02T18:40:33.378896+00:00

Affected: Bitnami: keycloak

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1078 certfr-2026-avi-1078 — De multiples vulnérabilités ont été découvertes dans Keycloak. Elles permettent à un attaquant de provoquer un contourn… 2026-10-02T18:40:33.378952+00:00 certfr-2026-avi-1078 https://cve.radiocsirt.org/vuln/euvd-2026-355274 EUVD-2026-355274 2026-10-02T18:40:33.378975+00:00 EUVD-2026-355274 https://cve.radiocsirt.org/vuln/fkie_cve-2026-17048 fkie_cve-2026-17048 2026-10-02T18:40:33.378988+00:00

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.

 https://cve.radiocsirt.org/vuln/ghsa-p3wj-5684-x596 GHSA-p3wj-5684-x596 2026-10-02T18:40:33.379011+00:00

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.

 https://cve.radiocsirt.org/vuln/ncsc-2026-0326 NCSC-2026-0326 — Kwetsbaarheden verholpen in Keycloak 2026-10-02T18:40:33.379027+00:00 NCSC-2026-0326 https://cve.radiocsirt.org/vuln/rhsa-2026:56523 RHSA-2026:56523 — Red Hat Security Advisory: Red Hat build of Keycloak 26.6.6 Security Update 2026-10-02T18:40:33.379052+00:00

keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission keycloak-services: keycloak-services: Predictable account-linking hash enables account takeover via malicious OIDC client keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2517 WID-SEC-W-2026-2517 — Keycloak: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen 2026-10-02T18:40:33.379076+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen.