https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:32:53.794406+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-369928 EUVD-2026-369928 2026-10-03T04:32:53.806098+00:00 EUVD-2026-369928 https://cve.radiocsirt.org/vuln/fkie_cve-2026-19607 fkie_cve-2026-19607 2026-10-03T04:32:53.806138+00:00

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.

 https://cve.radiocsirt.org/vuln/ghsa-h87q-rx56-87wm GHSA-h87q-rx56-87wm 2026-10-03T04:32:53.806170+00:00

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.

 https://cve.radiocsirt.org/vuln/rhsa-2026:68276 RHSA-2026:68276 — Red Hat Security Advisory: Red Hat build of Keycloak 26.4.16 Images Security Update 2026-10-03T04:32:53.806186+00:00

keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts keycloak-services: keycloak-services: SAML Redirect DEFLATE helpers leak native zlib state keycloak-services: keycloak-services: Broker-originated username collision causes account lockout keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-19607 UBUNTU-CVE-2026-19607 2026-10-03T04:32:53.806212+00:00

Affected: Ubuntu:24.04:LTS: python-keycloak

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3418 WID-SEC-W-2026-3418 — Keycloak: Mehrere Schwachstellen 2026-10-03T04:32:53.806232+00:00

Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen und um Informationen offenzulegen.