https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-17T05:27:01.538264+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cnvd-2020-35686 cnvd-2020-35686 2026-10-17T05:27:01.544241+00:00 cnvd-2020-35686 https://cve.radiocsirt.org/vuln/euvd-2026-39981 EUVD-2026-39981 2026-10-17T05:27:01.544273+00:00 EUVD-2026-39981 https://cve.radiocsirt.org/vuln/fkie_cve-2020-10686 fkie_cve-2020-10686 2026-10-17T05:27:01.544288+00:00

A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.

 https://cve.radiocsirt.org/vuln/ghsa-9695-w6h2-jpv9 GHSA-9695-w6h2-jpv9 — Keycloak users may be able to remove MFA from other users' devices 2026-10-17T05:27:01.544315+00:00

Affected: Maven: org.keycloak:keycloak-core

A community-only flaw was found where a malicious user can register himself and then uses the "remove devices" form to post different credential ids with the hope of removing MFA devices for other users.

 https://cve.radiocsirt.org/vuln/gsd-2020-10686 gsd-2020-10686 2026-10-17T05:27:01.544339+00:00 gsd-2020-10686