Schwachstellen, die jetzt zählen.

keycloak-services: keycloak-services: Protocol mapper with jsonType=JSON bypasses token sanitization

keycloak-services: keycloak-services: Client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator…

keycloak-services: keycloak-services: DCR azp and sid claim substitution allows Account REST session takeover

CVE-2026-97175

keycloak-services: keycloak-services: CIBA sub parameter injection causes attacker authentication to issue victim tokens

keycloak-services: keycloak-services: DCR registration-time claim-path gap allows forging realm_access.roles

keycloak-services: keycloak-services: Indefinite access token renewal via Standard Token Exchange V2

org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates

keycloak-services: keycloak-services: Stateless token preferred_username fallback enables identity rebinding

keycloak-core: keycloak-core: SAML adapter does not bind signed assertions to the configured identity provider issuer

keycloak-services: keycloak-services: DCR protocol mapper config not validated, allowing IAT holders to forge sub and aud claims in signed tokens

keycloak-services: keycloak-services: SAML broker ignores ProxyRestriction delegation constraints

keycloak-services: keycloak-services: SAML broker accepts holder-of-key assertions without proof of key possession

keycloak-services: keycloak-services: Unauthenticated Denial of Service via SAML SOAP endpoint unbounded XML parsing

keycloak-services: keycloak-services: Admin API missing audience check

ansible-core: no_log does not censor the task exception field, leaking secret values via the default stdout callback

quarkus-rest-data-panache: quarkus-rest-data-panache: getter-level @SecureField ignored for filter and sort

keycloak-services: keycloak-services: SAML redirect binding signature bypass via percent-encoded parameter names

keycloak-services: keycloak-services: UMA Protection API resourceType field not validated — cross-owner resource access

keycloak-services: keycloak-services: Account takeover via stale SSO_AUTH note in Organization identity-first login

keycloak-services: keycloak-services: Unauthenticated JVM termination via SAML 1.1 AuthorityBinding parsing loop

CVE-2026-109081

keycloak-services: keycloak-services: Unauthenticated CPU exhaustion via SAML 1.1 KeyInfo infinite loop

keycloak-services: keycloak-services: OIDC logout endpoint session fixation via id_token_hint leading to account takeover

keycloak-services: keycloak-services: Unauthenticated CPU denial of service via SAML XML dateTime and duration parsing

CVE-2026-103112

VeraCrypt provides disk encryption with strong security based on TrueCrypt.

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and count values when deserializing data that can cross from the unprivileged GUI or CLI to the root CoreService helper. Serializer::DeserializeWString allocates floor(size / sizeof(wchar_t)) elements but reads size bytes, so a non-aligned size…

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services.

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidc_service.go accepts the client-controlled resource parameter and embeds it directly in the access token aud claim without validating that the audience is registered or that the requesting client may access it. Any authenticated OIDC client can therefore obtain a Pocket ID-signed token…

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services.

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/email_verification_token.go to bind an email-verification token only to the user's identifier, while UpdateUser can change the account email without invalidating the outstanding token and VerifyEmail marks the current address as verified. An ordinary user can request a token for an…

dulwich: dulwich: Arbitrary code execution via duplicate tree header parsing