agentprime: red-hat-build-of-keycloak-26-6Every new CVE for red-hat-build-of-keycloak-26-6.https://agentprime.io/CVE-2026-19607: Keycloak-services: keycloak-services: broker-originated username collision causes account lockouthttps://agentprime.io/advisories/CVE-2026-19607/https://agentprime.io/advisories/CVE-2026-19607/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 15:46:43 GMTCVECVE-2026-17526: Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accountshttps://agentprime.io/advisories/CVE-2026-17526/https://agentprime.io/advisories/CVE-2026-17526/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 15:46:13 GMTCVECVE-2026-79651: Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale cachinghttps://agentprime.io/advisories/CVE-2026-79651/https://agentprime.io/advisories/CVE-2026-79651/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 14:55:09 GMTCVECVE-2026-74909: Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segmentshttps://agentprime.io/advisories/CVE-2026-74909/https://agentprime.io/advisories/CVE-2026-74909/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 14:54:47 GMTCVECVE-2026-18212: Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib statehttps://agentprime.io/advisories/CVE-2026-18212/https://agentprime.io/advisories/CVE-2026-18212/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 16 Sep 2026 14:54:15 GMTCVECVE-2026-19729: Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parametershttps://agentprime.io/advisories/CVE-2026-19729/https://agentprime.io/advisories/CVE-2026-19729/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 09 Sep 2026 07:03:35 GMTCVECVE-2026-17615: Resteasy-core: resteasy sourceprovider remote unauthenticated file readhttps://agentprime.io/advisories/CVE-2026-17615/https://agentprime.io/advisories/CVE-2026-17615/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 31 Aug 2026 16:15:01 GMTCVECVE-2026-79652: Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequiredhttps://agentprime.io/advisories/CVE-2026-79652/https://agentprime.io/advisories/CVE-2026-79652/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 25 Aug 2026 11:07:48 GMTCVECVE-2026-15571: Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc clienthttps://agentprime.io/advisories/CVE-2026-15571/https://agentprime.io/advisories/CVE-2026-15571/CVSS 7.3 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 18 Aug 2026 20:40:17 GMTCVECVE-2026-15572: Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalationhttps://agentprime.io/advisories/CVE-2026-15572/https://agentprime.io/advisories/CVE-2026-15572/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Aug 2026 15:09:23 GMTCVECVE-2026-16442: Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restrictionhttps://agentprime.io/advisories/CVE-2026-16442/https://agentprime.io/advisories/CVE-2026-16442/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Aug 2026 15:00:39 GMTCVECVE-2026-16100: Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error texthttps://agentprime.io/advisories/CVE-2026-16100/https://agentprime.io/advisories/CVE-2026-16100/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Aug 2026 13:50:57 GMTCVECVE-2026-16071: Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundaryhttps://agentprime.io/advisories/CVE-2026-16071/https://agentprime.io/advisories/CVE-2026-16071/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Aug 2026 13:50:54 GMTCVECVE-2026-16102: Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappershttps://agentprime.io/advisories/CVE-2026-16102/https://agentprime.io/advisories/CVE-2026-16102/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Aug 2026 13:50:50 GMTCVECVE-2026-15573: Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcherhttps://agentprime.io/advisories/CVE-2026-15573/https://agentprime.io/advisories/CVE-2026-15573/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Aug 2026 13:50:03 GMTCVECVE-2026-16443: Keycloak-services: keycloak-services: saml broker metadata import disables response signature validationhttps://agentprime.io/advisories/CVE-2026-16443/https://agentprime.io/advisories/CVE-2026-16443/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 05 Aug 2026 13:44:09 GMTCVECVE-2026-18573: Keycloak-services: keycloak-services: client access-type policy condition bypass during client updatehttps://agentprime.io/advisories/CVE-2026-18573/https://agentprime.io/advisories/CVE-2026-18573/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 02 Aug 2026 05:28:43 GMTCVECVE-2026-18572: Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributeshttps://agentprime.io/advisories/CVE-2026-18572/https://agentprime.io/advisories/CVE-2026-18572/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 02 Aug 2026 05:18:58 GMTCVECVE-2026-18571: Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creationhttps://agentprime.io/advisories/CVE-2026-18571/https://agentprime.io/advisories/CVE-2026-18571/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 02 Aug 2026 05:18:50 GMTCVECVE-2026-18570: Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowedhttps://agentprime.io/advisories/CVE-2026-18570/https://agentprime.io/advisories/CVE-2026-18570/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 02 Aug 2026 05:18:42 GMTCVECVE-2026-18209: Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution checkhttps://agentprime.io/advisories/CVE-2026-18209/https://agentprime.io/advisories/CVE-2026-18209/CVSS 3.4 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 07:08:31 GMTCVECVE-2026-18214: Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restrictionhttps://agentprime.io/advisories/CVE-2026-18214/https://agentprime.io/advisories/CVE-2026-18214/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 07:08:26 GMTCVECVE-2026-16105: Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpointshttps://agentprime.io/advisories/CVE-2026-16105/https://agentprime.io/advisories/CVE-2026-16105/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 07:03:36 GMTCVECVE-2026-18215: Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenanthttps://agentprime.io/advisories/CVE-2026-18215/https://agentprime.io/advisories/CVE-2026-18215/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 06:48:14 GMTCVECVE-2026-18218: Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzerohttps://agentprime.io/advisories/CVE-2026-18218/https://agentprime.io/advisories/CVE-2026-18218/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 31 Jul 2026 06:38:18 GMTCVECVE-2026-18201: Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizationshttps://agentprime.io/advisories/CVE-2026-18201/https://agentprime.io/advisories/CVE-2026-18201/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 29 Jul 2026 08:34:47 GMTCVECVE-2026-17059: Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filterhttps://agentprime.io/advisories/CVE-2026-17059/https://agentprime.io/advisories/CVE-2026-17059/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Jul 2026 14:06:21 GMTCVECVE-2026-17048: Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest apihttps://agentprime.io/advisories/CVE-2026-17048/https://agentprime.io/advisories/CVE-2026-17048/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 24 Jul 2026 13:41:09 GMTCVECVE-2026-16104: Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only adminshttps://agentprime.io/advisories/CVE-2026-16104/https://agentprime.io/advisories/CVE-2026-16104/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Jul 2026 16:43:54 GMTCVECVE-2026-16106: Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roleshttps://agentprime.io/advisories/CVE-2026-16106/https://agentprime.io/advisories/CVE-2026-16106/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Jul 2026 16:43:16 GMTCVECVE-2026-16108: Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2https://agentprime.io/advisories/CVE-2026-16108/https://agentprime.io/advisories/CVE-2026-16108/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Jul 2026 16:43:14 GMTCVECVE-2026-16093: Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headershttps://agentprime.io/advisories/CVE-2026-16093/https://agentprime.io/advisories/CVE-2026-16093/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Jul 2026 16:42:52 GMTCVECVE-2026-16089: Keycloak-services: keycloak-services: authorization codes can be retargeted to another client sessionhttps://agentprime.io/advisories/CVE-2026-16089/https://agentprime.io/advisories/CVE-2026-16089/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Jul 2026 14:15:43 GMTCVECVE-2026-16072: Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creationhttps://agentprime.io/advisories/CVE-2026-16072/https://agentprime.io/advisories/CVE-2026-16072/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Jul 2026 13:40:01 GMTCVECVE-2026-15945: Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2https://agentprime.io/advisories/CVE-2026-15945/https://agentprime.io/advisories/CVE-2026-15945/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 16 Jul 2026 17:36:24 GMTCVECVE-2026-14615: Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filterhttps://agentprime.io/advisories/CVE-2026-14615/https://agentprime.io/advisories/CVE-2026-14615/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Jul 2026 15:47:08 GMTCVECVE-2026-14614: Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresourcehttps://agentprime.io/advisories/CVE-2026-14614/https://agentprime.io/advisories/CVE-2026-14614/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Jul 2026 15:33:00 GMTCVECVE-2026-14613: Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permissionhttps://agentprime.io/advisories/CVE-2026-14613/https://agentprime.io/advisories/CVE-2026-14613/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Jul 2026 15:16:44 GMTCVECVE-2026-14209: Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictionshttps://agentprime.io/advisories/CVE-2026-14209/https://agentprime.io/advisories/CVE-2026-14209/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Jun 2026 11:48:26 GMTCVECVE-2026-9099: Keycloak: group-admin escalation to realm-adminhttps://agentprime.io/advisories/CVE-2026-9099/https://agentprime.io/advisories/CVE-2026-9099/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 16:16:43 GMTCVE