cve
Articles tagged with cve.
Apache CXF CVE-2026-50627: JWT Audience Checks for Keycloak APIs
CVE-2026-50627 let Apache CXF skip the JWT audience claim check. Here is what every resource server must validate on Keycloak…
12 min readOpenAM PKCE Bypass and JWKS SSRF (2026): Lessons for Keycloak OIDC Clients
OpenAM before 16.1.3 skipped PKCE on hybrid flows (CVE-2026-105119) and fetched unvalidated jwks_uri values (CVE-2026-105122). Here is the Keycloak checklist.
11 min readCVE-2026-107121: Keycloak SMTP StartTLS Plaintext Downgrade
Keycloak 26.8.1 fixes CVE-2026-107121: realm SMTP with StartTLS on could still send credentials in plaintext. What changed, who is affected,…
8 min readKeycloak CVE-2026-103884: X.509 CRL Path Traversal When CRL Checking Is On
CVE-2026-103884 lets a crafted client certificate steer Keycloak's X.509 CRL loader outside its conf directory. Who is exposed, the real…
12 min readCVE-2026-5430: WSO2 JWT Bypass and Your Keycloak APIs
CVE-2026-5430 let forged JWTs past WSO2 API Manager authentication. Here is how you pin algorithms and fail closed on APIs…
12 min readCVE-2026-100606: Flowise SSO Invite Takeover and IdP Checks
CVE-2026-100606 lets anyone who signs in with an invitee's email take over a pending Flowise Enterprise invite. How it works…
9 min readCVE-2026-96448: Keycloak FGAP Composite Privilege Escalation
CVE-2026-96448 is a Keycloak privilege escalation: an FGAP v2 delegated admin assigns a composite role that hides realm-admin. How it…
11 min readKeycloak 26.7.4 Security Fixes: A Self-Hosted Patch Checklist
Keycloak 26.7.4 fixes six CVEs, from a SAML memory leak to impersonation of realm admins. Which reach 26.6 and 26.4,…
10 min readCVE-2026-19607: Keycloak Username Takeover and Account Lockout
CVE-2026-19607: a brokered login whose email matches a Keycloak username shadows that user and locks them out. Fixed in 26.7.4.…
11 min readCVE-2026-97176: Keycloak Step-Up Authentication Bypass
CVE-2026-97176 can let Keycloak issue a token at a lower assurance level than a client's essential acr demands, skipping step-up.…
9 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.