cve
Articles tagged with cve.
CVE-2026-97177: Keycloak Delegated Admin Account Takeover
CVE-2026-97177 enables account takeover in Keycloak: a delegated admin denied reset-password can still set passwords via user update. How it…
9 min readCVE-2026-97846: Keycloak Token Exchange Drops mTLS Binding
CVE-2026-97846 lets Keycloak standard token exchange issue an unbound Bearer token for an mTLS-bound client. What it breaks, who is…
11 min readCVE-2026-79651: Keycloak Unauthenticated Locale Cache DoS
CVE-2026-79651 lets anyone exhaust Keycloak heap via a public theme localization endpoint. It is fixed in 26.7.4, 26.6.7 and 26.4.16.…
10 min readCVE-2026-95503: Keycloak Kerberos Does Not Verify the KDC
CVE-2026-95503 lets an adjacent-network attacker spoof the KDC when Keycloak does Kerberos password authentication without SPNEGO. No fixed release yet.
10 min readCVE-2026-17526: Keycloak Impersonation Escalates to Realm Admin
CVE-2026-17526 let a Keycloak impersonation-role holder take over a realm admin. Fixed in 26.7.4 on 16 September 2026, and on…
8 min readCVE-2026-59822: LiteLLM's MCP Auth Bypass, and the Second Bug in the Same Fix
CVE-2026-59822 let any fabricated Bearer token open a LiteLLM MCP session. The two separate bugs one pull request closed, and…
11 min readCVE-2026-93999: Keycloak Refresh Restores a Disabled Audience
Keycloak checks an audience client is enabled during token exchange, but not when that refresh token is used. What CVE-2026-93999…
8 min readCVE-2026-17048: Keycloak's Admin REST API Can Hand Back a Vault-Resolved Client Secret
CVE-2026-17048 lets a view-only Keycloak admin read the plaintext of a vault-backed rotated client secret. CVSS 5.5, fixed in 26.7.2…
9 min readCVE-2026-88770: Keycloak's Device Flow Can Still Issue Tokens for a Locked Account
CVE-2026-88770 lets Keycloak's device authorization grant redeem tokens for an account brute-force protection already locked. CVSS 6.5, no patch yet.
8 min readCVE-2026-18963: The Keycloak Password Reset Takeover, and Which Versions Fix It
CVE-2026-18963 lets an unauthenticated attacker take over any Keycloak account through the reset-credentials flow. CVSS 9.1. Three release lines carry…
9 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.