← All credits
Red Hat would like to thank Paul Bottinelli (Trail of Bits in collaboration with OpenAI) for reporting this issue.
27 vulnerability records and advisories credit this contributor.
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
CVE-2026-18569
Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens
CVE-2026-18206
Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass
CVE-2026-18208
Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim
CVE-2026-18207
Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching
CVE-2026-18203
Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes
CVE-2026-15943
Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change
CVE-2026-96445
Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers
CVE-2026-18212
Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
CVE-2026-18573
Keycloak-services: keycloak-services: client access-type policy condition bypass during client update