← All credits
Red Hat would like to thank Paul Bottinelli (Trail of Bits in collaboration with OpenAI) for reporting this issue.
26 vulnerability records and advisories credit this contributor.
CVE-2026-96445
Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers
CVE-2026-18212
Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state
CVE-2026-18573
Keycloak-services: keycloak-services: client access-type policy condition bypass during client update
CVE-2026-18572
Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes
CVE-2026-18570
Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed
CVE-2026-18218
Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero
CVE-2026-18215
Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant
CVE-2026-18214
Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction
CVE-2026-18201
Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations
CVE-2026-16108
Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2