https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T04:22:33.867443+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-343616 EUVD-2026-343616 2026-10-03T04:22:33.942306+00:00 EUVD-2026-343616 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9087 fkie_cve-2026-9087 2026-10-03T04:22:33.942348+00:00

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

 https://cve.radiocsirt.org/vuln/ghsa-m6qj-3mpp-57v8 GHSA-m6qj-3mpp-57v8 — Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromi… 2026-10-03T04:22:33.942382+00:00

Affected: Maven: org.keycloak:keycloak-services

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it and get linked to the victim's local account.

 https://cve.radiocsirt.org/vuln/rhsa-2026:25097 RHSA-2026:25097 — Red Hat Security Advisory: Red Hat build of Keycloak 26.6.3 Images Update 2026-10-03T04:22:33.942407+00:00

org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: Keycloak: Server-Side Request Forgery via OIDC token endpoint manipulation org.keycloak.keycloak-services: Improper Access Control on Keycloak Server when the account Account API feature is disabled keycloak: org.keycloak/keycloak-services: Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: Security flaw in org.keycloak/keycloak-services keycloak: Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login keycloak: Keycloak: Information disclosure due to user profile permission bypass keycloak: Keycloak: Privilege escalation due to oversized subject_token JWT keycloak-rhel9: Organization Data Leak After Feature Disabled in Keycloak keycloak: Keycloak: Security restriction bypass allows unauthorized ROPC token acquisition keycloak: Keycloak: Information disclosure via SAML ECP endpoint keycloak: Keycloak: Denial of Service via malformed LDAP password policy response keycloak: Keycloak: Unauthorized account access via replayed refresh tokens after cluster restart keycloak: Keycloak: Denial of Service via malformed Authorization header keycloak: org.keycloak.protocol.oidc.grants.ciba: Keycloak: Information disclosure via CORS header injection due to unvalidated JWT azp claim

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1616 WID-SEC-W-2026-1616 — Keycloak: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-03T04:22:33.942445+00:00

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen.