Keycloak

Search everything

Mentions · 7d0
Mentions · 30d3
All mentions6
First seenAug 24, 2026
Last mentioned21d ago

Timeline

6 articles · newest first

Keycloak 26.7.2 unauthenticated account takeover exploit published

Exploit-DB lists a web-app exploit that takes over accounts in Keycloak 26.7.2 without authentication.

Exploit-DBOct 21, 00:00 UTC · 21d agoExploit / PoC1 · 1 read

CVE-2026-96806: Apache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token

Apache Airflow Keycloak logout fails to end sessions because middleware reissues an unrevoked JWT.

oss-securityOct 15, 23:05 UTC · 26d agoVulnerability 4 sourcesCVE-2026-968065 · 1 read

CVE-2026-92228: Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

Apache Airflow's Keycloak provider before 0.11.1 lets any team member read every team's audit logs.

oss-securityOct 15, 22:59 UTC · 26d agoVulnerability 4 sourcesCVE-2026-922283 · 1 read

OTel-Native by Design – Building Products That Export to Any Observability Stack

OpenTelemetry guidance explains how products can export logs, traces, and metrics to any OTLP backend.

Hacker News · securityOct 9, 06:54 UTC · Oct 9, 2026Other HN 28 points · 1 comments4 · 2 reads

Siemens Industrial Edge Management

Siemens Industrial Edge Management has a critical unauthenticated password-reset flaw enabling remote account takeover.

CISA AdvisoriesSep 22, 12:00 UTC · Sep 22, 2026Vulnerability 4 sourcesCVE-2026-189631 · 1 read

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.

The Hacker NewsAug 24, 11:56 UTC · Aug 24, 2026VulnerabilityCVE-2026-18963 CVE-2026-155715 · 2 reads

Related CVEs

by mentions

CVE-2026-189637%9.1
Unauthenticated Account Takeover via Password Reset Flow in Red Hat Build of Keycloak
published Aug 18, 2026Red Hat Build of Keycloak (keycloak-services component, reset-credentials flow)PoC ×4
CVE-2026-15571<1%7.3
Predictable-hash account-linking forgery in Keycloak enables full account takeover
published Aug 18, 2026Red Hat Keycloak
CVE-2026-922286.5
Cross-team audit log read in Airflow Keycloak provider
published 26d agoApache Software Foundation Apache Airflow Keycloak provider (apache-airflow-providers-keycloak)
CVE-2026-968065.8
Logout leaves session valid in Airflow Keycloak provider
published 26d agoApache Software Foundation apache-airflow-providers-keycloak

Appears with

Apache Software Foundationorganization · 2
Red Hatvendor · 2
Apache Airflowproduct · 2
Apache Airflow Keycloak providerproduct · 2
Univentionvendor · 1
New Relicorganization · 1
Siemens ProductCERTorganization · 1
OpenTelemetryproduct · 1
Herokuproduct · 1
Siemensvendor · 1
Cloudflarevendor · 1
Cloudflare Workersproduct · 1
OpenTelemetryorganization · 1
Industrial Edge Managementproduct · 1
Kumaproduct · 1
Apachevendor · 1

Entities are extracted by the model from each article. First seen Aug 24, 2026, last mentioned 21d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.