https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 09:03:06 +0000 https://cve.radiocsirt.org/vuln/bit-keycloak-2026-17048 <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.</p> <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.</p> https://cve.radiocsirt.org/vuln/bit-keycloak-2026-17048 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1078 certfr-2026-avi-1078 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1078 https://cve.radiocsirt.org/vuln/euvd-2026-355274 EUVD-2026-355274 https://cve.radiocsirt.org/vuln/euvd-2026-355274 https://cve.radiocsirt.org/vuln/fkie_cve-2026-17048 <p>A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.</p> <p>A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-17048 https://cve.radiocsirt.org/vuln/ghsa-p3wj-5684-x596 <p>A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.</p> <p>A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only permissions can retrieve the actual resolved secret instead of the vault placeholder, leading to the exposure of sensitive credentials.</p> https://cve.radiocsirt.org/vuln/ghsa-p3wj-5684-x596 https://cve.radiocsirt.org/vuln/ncsc-2026-0326 NCSC-2026-0326 https://cve.radiocsirt.org/vuln/ncsc-2026-0326 https://cve.radiocsirt.org/vuln/rhsa-2026:56523 <p>keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission keycloak-services: keycloak-services: Predictable account-linking hash enables account takeover via malicious OIDC client keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass</p> <p>keycloak: Keycloak: Privilege escalation via Time-of-Check to Time-of-Use (TOCTOU) vulnerability keycloak-services: keycloak-services: Keycloak: FGAP v2 role groups endpoint discloses hidden group metadata without group view permission keycloak-services: keycloak-services: Predictable account-linking hash enables account takeover via malicious OIDC client keycloak-services: keycloak-services: Vault-resolved rotated client secrets leaked via Admin REST API keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass</p> https://cve.radiocsirt.org/vuln/rhsa-2026:56523 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2517 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2517