Rezultati pretraživanja za 'Proizvođač: redhat'
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-14615 | 4.3 | A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is enabled, the system fails to properly filter child groups based on the caller's specific permissions when reque | 2026-08-11 14:45:58 | 2026-07-03 16:16:55 |
| CVE-2026-11986 | 4.9 | A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue occurs because certain bulk role-removal endpoints fail to perform granular permission checks when deleting role | 2026-08-11 12:58:09 | 2026-06-11 18:16:25 |
| CVE-2026-9796 | 6.5 | A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use (TOCTOU) vulnerability in the name-based admin role checks. This allows the attacker to escalate their privileges t | 2026-08-11 12:17:44 | 2026-05-28 05:16:41 |
| CVE-2026-18207 | 6.5 | A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by | 2026-08-11 01:35:13 | 2026-07-29 10:16:40 |
| CVE-2026-14781 | 4.8 | A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves | 2026-08-11 01:13:00 | 2026-07-05 07:16:39 |
| CVE-2026-15572 | 8.8 | A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a clien | 2026-08-10 19:23:37 | 2026-08-05 16:16:50 |
| CVE-2026-16442 | 7.4 | A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account l | 2026-08-10 19:21:47 | 2026-08-05 16:16:52 |
| CVE-2026-18967 | 6.4 | A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows a | 2026-08-10 19:15:58 | 2026-08-06 07:16:29 |
| CVE-2026-18569 | 3.7 | A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC ident | 2026-08-10 19:06:53 | 2026-08-04 06:16:30 |
| CVE-2026-16443 | 7.4 | A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attribute | 2026-08-10 18:52:14 | 2026-08-05 14:17:03 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/904
Zapisa po stranici: