https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 06:17:45 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0159 certfr-2026-avi-0159 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0159 https://cve.radiocsirt.org/vuln/euvd-2026-337533 EUVD-2026-337533 https://cve.radiocsirt.org/vuln/euvd-2026-337533 https://cve.radiocsirt.org/vuln/fkie_cve-2026-1486 <p>A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP&#39;s signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.</p> <p>A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP&#39;s signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-1486 https://cve.radiocsirt.org/vuln/ghsa-37gf-gmxv-74wv <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-services</p> <p>A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP&#39;s signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.</p> <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-services</p> <p>A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFromIssuer) retrieves the IdP configuration but does not filter for isEnabled=false. If an administrator disables an IdP (e.g., due to a compromise or offboarding), an entity possessing that IdP&#39;s signing key can still generate valid JWT assertions that Keycloak accepts, resulting in the issuance of valid access tokens.</p> https://cve.radiocsirt.org/vuln/ghsa-37gf-gmxv-74wv https://cve.radiocsirt.org/vuln/rhsa-2026:2365 <p>org.keycloak.services.resources.admin: Keycloak: Limited administrator can retrieve sensitive user attributes via Admin API org.keycloak/keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users keycloak: Incorrect ownership checks in /uma-policy/ org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators org.keycloak.protocol.oidc.grants: Disabled identity providers are still accepted for JWT Authorization Grant org.keycloak.services.resources.organizations: Keycloak: Unauthorized organization registration via improper invitation token validation</p> <p>org.keycloak.services.resources.admin: Keycloak: Limited administrator can retrieve sensitive user attributes via Admin API org.keycloak/keycloak-services: Keycloak keycloak-services: Business logic flaw allows unauthorized token issuance for disabled users keycloak: Incorrect ownership checks in /uma-policy/ org.keycloak/keycloak-services: Keycloak: Unauthorized modification of unmanaged user attributes by administrators org.keycloak.protocol.oidc.grants: Disabled identity providers are still accepted for JWT Authorization Grant org.keycloak.services.resources.organizations: Keycloak: Unauthorized organization registration via improper invitation token validation</p> https://cve.radiocsirt.org/vuln/rhsa-2026:2365 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0356 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen und Sicherheitsmaßnahmen zu umgehen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen und Sicherheitsmaßnahmen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0356