agentprime: red-hat-build-of-keycloak

agentprime: red-hat-build-of-keycloakEvery new CVE for red-hat-build-of-keycloak.https://agentprime.io/CVE-2026-97847: Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authorityhttps://agentprime.io/advisories/CVE-2026-97847/https://agentprime.io/advisories/CVE-2026-97847/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:16:10 GMTCVECVE-2026-97175: Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeoverhttps://agentprime.io/advisories/CVE-2026-97175/https://agentprime.io/advisories/CVE-2026-97175/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:16:04 GMTCVECVE-2026-97174: Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokenshttps://agentprime.io/advisories/CVE-2026-97174/https://agentprime.io/advisories/CVE-2026-97174/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:15:54 GMTCVECVE-2026-96453: Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificateshttps://agentprime.io/advisories/CVE-2026-96453/https://agentprime.io/advisories/CVE-2026-96453/CVSS 8.0 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:15:42 GMTCVECVE-2026-93998: Keycloak-core: keycloak-core: saml adapter does not bind signed assertions to the configured identity provider issuerhttps://agentprime.io/advisories/CVE-2026-93998/https://agentprime.io/advisories/CVE-2026-93998/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:15:33 GMTCVECVE-2026-92857: Keycloak-services: keycloak-services: dcr protocol mapper config not validated, allowing iat holders to forge sub and aud claims in signed tokenshttps://agentprime.io/advisories/CVE-2026-92857/https://agentprime.io/advisories/CVE-2026-92857/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:15:24 GMTCVECVE-2026-92855: Keycloak-services: keycloak-services: saml broker accepts holder-of-key assertions without proof of key possessionhttps://agentprime.io/advisories/CVE-2026-92855/https://agentprime.io/advisories/CVE-2026-92855/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:15:07 GMTCVECVE-2026-82965: Keycloak-services: keycloak-services: unauthenticated denial of service via saml soap endpoint unbounded xml parsinghttps://agentprime.io/advisories/CVE-2026-82965/https://agentprime.io/advisories/CVE-2026-82965/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 17:14:20 GMTCVECVE-2026-114232: Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource accesshttps://agentprime.io/advisories/CVE-2026-114232/https://agentprime.io/advisories/CVE-2026-114232/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:05:41 GMTCVECVE-2026-112208: Keycloak-services: keycloak-services: account takeover via stale sso_auth note in organization identity-first loginhttps://agentprime.io/advisories/CVE-2026-112208/https://agentprime.io/advisories/CVE-2026-112208/CVSS 8.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:05:05 GMTCVECVE-2026-110932: Keycloak-services: keycloak-services: unauthenticated persistent disk exhaustion via theme gzip cachehttps://agentprime.io/advisories/CVE-2026-110932/https://agentprime.io/advisories/CVE-2026-110932/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:04:56 GMTCVECVE-2026-110931: Keycloak-services: keycloak-services: unauthenticated jvm termination via saml 1.1 authoritybinding parsing loophttps://agentprime.io/advisories/CVE-2026-110931/https://agentprime.io/advisories/CVE-2026-110931/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:04:53 GMTCVECVE-2026-107602: Keycloak-services: keycloak-services: unauthenticated cpu exhaustion via saml 1.1 keyinfo infinite loophttps://agentprime.io/advisories/CVE-2026-107602/https://agentprime.io/advisories/CVE-2026-107602/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:04:51 GMTCVECVE-2026-103112: Keycloak-services: keycloak-services: account takeover via authentication race using reset-credentials pathhttps://agentprime.io/advisories/CVE-2026-103112/https://agentprime.io/advisories/CVE-2026-103112/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:04:47 GMTCVECVE-2026-107123: Keycloak-services: keycloak-services: unauthenticated cpu denial of service via saml xml datetime and duration parsinghttps://agentprime.io/advisories/CVE-2026-107123/https://agentprime.io/advisories/CVE-2026-107123/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 16:04:47 GMTCVECVE-2026-117691: Keycloak-services: keycloak-services: saml redirect binding signature bypass via percent-encoded parameter nameshttps://agentprime.io/advisories/CVE-2026-117691/https://agentprime.io/advisories/CVE-2026-117691/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:27:23 GMTCVEcriticalCVE-2026-107912: Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flawhttps://agentprime.io/advisories/CVE-2026-107912/https://agentprime.io/advisories/CVE-2026-107912/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Nov 2026 13:27:11 GMTCVECVE-2026-120971: Org.jboss.resteasy/resteasy-core: resteasy: information disclosure through default exception mapper responseshttps://agentprime.io/advisories/CVE-2026-120971/https://agentprime.io/advisories/CVE-2026-120971/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Nov 2026 04:16:03 GMTCVECVE-2026-118959: Keycloak-services: keycloak-services: required actions bypassed via kc_action parameterhttps://agentprime.io/advisories/CVE-2026-118959/https://agentprime.io/advisories/CVE-2026-118959/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 00:15:31 GMTCVECVE-2026-118947: Keycloak-services: keycloak-services: authorization bypass via uma resource registration idorhttps://agentprime.io/advisories/CVE-2026-118947/https://agentprime.io/advisories/CVE-2026-118947/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 00:13:56 GMTCVECVE-2026-118425: Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopbackhttps://agentprime.io/advisories/CVE-2026-118425/https://agentprime.io/advisories/CVE-2026-118425/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 13:58:32 GMTCVECVE-2026-118030: Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent loginshttps://agentprime.io/advisories/CVE-2026-118030/https://agentprime.io/advisories/CVE-2026-118030/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 06:22:11 GMTCVECVE-2026-117859: Keycloak-services: keycloak-services: par single-use bypass via flow restarthttps://agentprime.io/advisories/CVE-2026-117859/https://agentprime.io/advisories/CVE-2026-117859/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 06:22:11 GMTCVECVE-2026-117688: Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configurationhttps://agentprime.io/advisories/CVE-2026-117688/https://agentprime.io/advisories/CVE-2026-117688/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 06:22:06 GMTCVECVE-2026-117627: Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictionshttps://agentprime.io/advisories/CVE-2026-117627/https://agentprime.io/advisories/CVE-2026-117627/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 29 Oct 2026 06:22:03 GMTCVECVE-2026-114438: Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action orderinghttps://agentprime.io/advisories/CVE-2026-114438/https://agentprime.io/advisories/CVE-2026-114438/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 21 Oct 2026 19:35:37 GMTCVECVE-2026-109082: Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clientshttps://agentprime.io/advisories/CVE-2026-109082/https://agentprime.io/advisories/CVE-2026-109082/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 12 Oct 2026 06:18:08 GMTCVECVE-2026-107889: Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypasshttps://agentprime.io/advisories/CVE-2026-107889/https://agentprime.io/advisories/CVE-2026-107889/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 09 Oct 2026 04:28:55 GMTCVECVE-2026-107623: Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocationhttps://agentprime.io/advisories/CVE-2026-107623/https://agentprime.io/advisories/CVE-2026-107623/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 14:39:35 GMTCVECVE-2026-107604: Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpointshttps://agentprime.io/advisories/CVE-2026-107604/https://agentprime.io/advisories/CVE-2026-107604/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 08 Oct 2026 14:39:32 GMTCVECVE-2026-107121: Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgradehttps://agentprime.io/advisories/CVE-2026-107121/https://agentprime.io/advisories/CVE-2026-107121/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 07 Oct 2026 07:42:04 GMTCVECVE-2026-105305: Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcementhttps://agentprime.io/advisories/CVE-2026-105305/https://agentprime.io/advisories/CVE-2026-105305/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 06 Oct 2026 07:33:32 GMTCVECVE-2026-105306: Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registrationhttps://agentprime.io/advisories/CVE-2026-105306/https://agentprime.io/advisories/CVE-2026-105306/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 05:56:51 GMTCVECVE-2026-105302: Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokenshttps://agentprime.io/advisories/CVE-2026-105302/https://agentprime.io/advisories/CVE-2026-105302/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 05 Oct 2026 05:51:58 GMTCVECVE-2026-103884: Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file readhttps://agentprime.io/advisories/CVE-2026-103884/https://agentprime.io/advisories/CVE-2026-103884/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 01 Oct 2026 17:16:21 GMTCVECVE-2026-101333: Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpointhttps://agentprime.io/advisories/CVE-2026-101333/https://agentprime.io/advisories/CVE-2026-101333/CVSS 3.7 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 28 Sep 2026 14:38:15 GMTCVECVE-2026-96448: Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalationhttps://agentprime.io/advisories/CVE-2026-96448/https://agentprime.io/advisories/CVE-2026-96448/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 07:39:51 GMTCVECVE-2026-97846: Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key bindinghttps://agentprime.io/advisories/CVE-2026-97846/https://agentprime.io/advisories/CVE-2026-97846/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 25 Sep 2026 06:16:38 GMTCVECVE-2026-97311: Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorizationhttps://agentprime.io/advisories/CVE-2026-97311/https://agentprime.io/advisories/CVE-2026-97311/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 11:28:39 GMTCVECVE-2026-97177: Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permissionhttps://agentprime.io/advisories/CVE-2026-97177/https://agentprime.io/advisories/CVE-2026-97177/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 05:47:57 GMTCVECVE-2026-97176: Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticatorhttps://agentprime.io/advisories/CVE-2026-97176/https://agentprime.io/advisories/CVE-2026-97176/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 24 Sep 2026 05:47:52 GMTCVECVE-2026-96445: Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headershttps://agentprime.io/advisories/CVE-2026-96445/https://agentprime.io/advisories/CVE-2026-96445/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 11:12:46 GMTCVECVE-2026-96446: Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication pathhttps://agentprime.io/advisories/CVE-2026-96446/https://agentprime.io/advisories/CVE-2026-96446/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 23 Sep 2026 11:03:50 GMTCVECVE-2026-95503: Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabledhttps://agentprime.io/advisories/CVE-2026-95503/https://agentprime.io/advisories/CVE-2026-95503/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 22 Sep 2026 07:43:29 GMTCVECVE-2026-94218: Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpointhttps://agentprime.io/advisories/CVE-2026-94218/https://agentprime.io/advisories/CVE-2026-94218/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 06:45:34 GMTCVECVE-2026-94217: Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collisionhttps://agentprime.io/advisories/CVE-2026-94217/https://agentprime.io/advisories/CVE-2026-94217/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 06:45:27 GMTCVECVE-2026-94215: Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership checkhttps://agentprime.io/advisories/CVE-2026-94215/https://agentprime.io/advisories/CVE-2026-94215/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 06:03:43 GMTCVECVE-2026-94213: Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identityhttps://agentprime.io/advisories/CVE-2026-94213/https://agentprime.io/advisories/CVE-2026-94213/CVSS 4.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 06:03:37 GMTCVECVE-2026-94001: Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permissionhttps://agentprime.io/advisories/CVE-2026-94001/https://agentprime.io/advisories/CVE-2026-94001/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 19 Sep 2026 14:11:53 GMTCVECVE-2026-94000: Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membershiphttps://agentprime.io/advisories/CVE-2026-94000/https://agentprime.io/advisories/CVE-2026-94000/CVSS 6.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 19 Sep 2026 14:09:17 GMTCVE