https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 03:42:28 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-369928 EUVD-2026-369928 https://cve.radiocsirt.org/vuln/euvd-2026-369928 https://cve.radiocsirt.org/vuln/fkie_cve-2026-19607 <p>A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.</p> <p>A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-19607 https://cve.radiocsirt.org/vuln/ghsa-h87q-rx56-87wm <p>A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.</p> <p>A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.</p> https://cve.radiocsirt.org/vuln/ghsa-h87q-rx56-87wm https://cve.radiocsirt.org/vuln/rhsa-2026:68276 <p>keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts keycloak-services: keycloak-services: SAML Redirect DEFLATE helpers leak native zlib state keycloak-services: keycloak-services: Broker-originated username collision causes account lockout keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching</p> <p>keycloak-services: keycloak-services: Privilege escalation via impersonation role allows takeover of realm administrator accounts keycloak-services: keycloak-services: SAML Redirect DEFLATE helpers leak native zlib state keycloak-services: keycloak-services: Broker-originated username collision causes account lockout keycloak-services: keycloak-services: Incomplete fix for arbitrary filesystem path probing via keystore parameters io.netty/netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration keycloak-services: keycloak-services: Incomplete fix for CVE-2026-15573 allows policy enforcer bypass via percent-encoded URI segments keycloak-services: keycloak-services: unauthenticated DoS via unbounded locale caching</p> https://cve.radiocsirt.org/vuln/rhsa-2026:68276 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-19607 <p><strong>Affected:</strong> Ubuntu:24.04:LTS: python-keycloak</p> <p>A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.</p> <p><strong>Affected:</strong> Ubuntu:24.04:LTS: python-keycloak</p> <p>A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to trigger a collision in Keycloak, which results in the legitimate user being locked out of their account.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-19607 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3418 <p>Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen und um Informationen offenzulegen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um seine Privilegien zu erhöhen, um einen Denial of Service Angriff durchzuführen und um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-3418