https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 14:11:32 +0000 https://cve.radiocsirt.org/vuln/bit-keycloak-2026-18209 <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker&#39;s injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.</p> <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker&#39;s injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.</p> https://cve.radiocsirt.org/vuln/bit-keycloak-2026-18209 https://cve.radiocsirt.org/vuln/cleanstart-2026-li01273 <p><strong>Affected:</strong> CleanStart: keycloak</p> <p>Security vulnerability affects the keycloak package. A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows.</p> <p><strong>Affected:</strong> CleanStart: keycloak</p> <p>Security vulnerability affects the keycloak package. A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-li01273 https://cve.radiocsirt.org/vuln/euvd-2026-369948 EUVD-2026-369948 https://cve.radiocsirt.org/vuln/euvd-2026-369948 https://cve.radiocsirt.org/vuln/fkie_cve-2026-18209 <p>A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker&#39;s injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.</p> <p>A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker&#39;s injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-18209 https://cve.radiocsirt.org/vuln/ghsa-c8xx-fr3x-6m5w <p>A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker&#39;s injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.</p> <p>A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker&#39;s injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.</p> https://cve.radiocsirt.org/vuln/ghsa-c8xx-fr3x-6m5w https://cve.radiocsirt.org/vuln/rhsa-2026:68277 <p>keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts resteasy-core: RESTeasy SourceProvider remote unauthenticated file read keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check keycloak-serv…</p> <p>keycloak-services: keycloak-services: Group hierarchy search discloses hidden parent groups under FGAP v2 keycloak-services: keycloak-services: Organization invitation link exposure allows unauthorized member creation keycloak-services: keycloak-services: Authorization codes can be retargeted to another client session keycloak-services: keycloak-services: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers keycloak-services: keycloak-services: Authenticator config endpoint exposes raw reCAPTCHA secrets to view-only admins keycloak-services: keycloak-services: Missing per-role authorization on RoleContainerResource composite endpoints keycloak-services: keycloak-services: Incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles keycloak-services: keycloak-services: Realm default-group reads disclose hidden groups under FGAP v2 keycloak-services: keycloak-services: Information disclosure via role-users endpoint bypasses per-user view filter keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts resteasy-core: RESTeasy SourceProvider remote unauthenticated file read keycloak-services: keycloak-services: Generic identity-provider creation can bind brokers to organizations without manage-organizations keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check keycloak-serv…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:68277 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2614 <p>Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und sensible Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und sensible Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2614