60
60
55
55
CVE-2026-78336: Apache Syncope: OIDCC4UI provider list discloses client secrets to any authenticated user
Apache Syncope's OIDCC4UI extension leaks OIDC client secrets in the provider list to any authenticated user, versions through 4.1.2 affected.
CVE-2026-78336 is a moderate-severity insertion-of-sensitive-information-into-sent-data flaw in Apache Syncope's syncope-ext-oidcc4ui-logic module. The OIDCC4UI provider list discloses client secrets to any authenticated user. Affected versions are 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.7, and 4.1.0-M0 through 4.1.2.
22
55
55
55
55
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account
Red Hat patched critical Keycloak flaw CVE-2026-18963 (CVSS 9.1) allowing unauthenticated attackers to take over any account, including administrative ones.
Keycloak and Red Hat patched CVE-2026-18963, a CVSS 9.1 flaw (CWE-640) caused by improper state validation in the reset-credentials flow, letting an unauthenticated remote attacker force a password reset without the emailed action token and achieve full account takeover, including admin accounts. Upstream Keycloak 26.7.2 and Red Hat Build of Keycloak 26.4.15/26.6.6 contain fixes; four RHSA errata were issued August 18, 2026. No evidence of exploitation or public exploits exists as of August 24, 2026; mitigation is disabling the Forgot Password feature in all realms.
78
60
42
42
42
30
30
55
55
55
55
55
60
60
55