Search: “Keycloak”

Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account

Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.

Keycloak and Red Hat patched CVE-2026-18963, a CVSS 9.1 flaw (CWE-640) caused by improper state validation in the reset-credentials flow, letting an unauthenticated remote attacker force a password reset without the emailed action token and achieve full account takeover, including admin accounts. Upstream Keycloak 26.7.2 and Red Hat Build of Keycloak 26.4.15/26.6.6 contain fixes; four RHSA errata were issued August 18, 2026. No evidence of exploitation or public exploits exists as of August 24, 2026; mitigation is disabling the Forgot Password feature in all realms.

The Hacker News·Aug 24, 11:56 UTC · 23d agoVulnerabilityCVE-2026-18963CVE-2026-15571

CVE-2026-76187: Apache Airflow Keycloak provider: Any realm client's credentials mint an Airflow session JWT

Apache Airflow Keycloak provider before 0.10.0 lets any confidential client's credentials in the realm mint an Airflow session JWT.

CVE-2026-76187 affects apache-airflow-providers-keycloak before 0.10.0. The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so credentials of an unrelated application can obtain an Airflow session JWT. Severity is rated moderate.

oss-security·Sep 15, 19:54 UTC · 1d agoVulnerability 2 sourcesCVE-2026-76187

Critical vulnerability in ManageEngine could lead to file creation, dozens of other vulnerabilities disclosed by Talos to start 2024

Cisco Talos·Jan 18, 13:56 UTC · Jan 18, 2024VulnerabilityCVE-2023-47211CVE-2023-38618CVE-2023-38621+52 CVEs

Don't let these open-source cybersecurity tools slip under your radar

Help Net Security·Jan 27, 00:00 UTC · Jan 27, 2025Vulnerability

Samba 4.24.0 ships Kerberos hardening and a CVE fix for domain encryption defaults

Help Net Security·Mar 19, 00:00 UTC · Mar 19, 2026VulnerabilityCVE-2026-20833