JVN iPedia advisory JVNDB-2026-026852
view advisory published 2026-08-05
A published security advisory; the vulnerabilities below are the ones it describes.
01
describes (31)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-22745US | — | — | ||
Spring MVC and WebFlux applications are vulnerable to Denial of Service attacks when resolving static resources.
More precisely, an application can be vulnerable when all the fol… | ||||
| CVE-2026-40975US | high7.5OT elevated | — | ||
Values produced by ${random.value} are not suitable for use as secrets. ${random.uuid} is not affected. ${random.int} and ${random.long} should never be used for secrets as they ar… | ||||
| CVE-2026-40972US | — | — | ||
An attacker on the same network as the remote application may be able to utilize a timing attack to discover information about the remote secret. In extreme circumstances this coul… | ||||
| CVE-2026-22748US | medium6.5 | — | ||
Vulnerability in Spring Spring Security. When an application configures JWT decoding with NimbusJwtDecoder or NimbusReactiveJwtDecoder, it must configure an OAuth2TokenValidator<J… | ||||
| CVE-2026-25854US | — | Exploit | ||
Occasional URL redirection to untrusted Site ('Open Redirect') vulnerability in Apache Tomcat via the LoadBalancerDrainingValve.
This issue affects Apache Tomcat: from 11.0.0-M1 t… | ||||
| CVE-2026-4634US | — | — | ||
A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the… | ||||
| CVE-2026-4325US | — | — | ||
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbi… | ||||
| CVE-2026-4282US | — | Exploit | ||
A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacke… | ||||
| CVE-2026-3872US | — | — | ||
A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (… | ||||
| CVE-2026-3121US | high7.2 | — | ||
A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This all… | ||||
| CVE-2026-2575US | — | — | ||
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAM… | ||||
| CVE-2026-2092US | — | — | ||
A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is… | ||||
| CVE-2026-2673US | — | — | ||
Issue summary: An OpenSSL TLS 1.3 server may fail to negotiate the expected
preferred key exchange group when its key exchange group configuration includes
the default by using the… | ||||
| CVE-2026-3429US | — | — | ||
A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance… | ||||
| CVE-2026-3911US | — | — | ||
A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative end… | ||||
| CVE-2026-3009US | high8.1OT elevated | — | ||
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by… | ||||
| CVE-2026-0871US | — | — | ||
A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modif… | ||||
| CVE-2025-11537US | — | — | ||
A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern (such as the pre-defined 'long' pattern), sensitive headers including Author… | ||||
| CVE-2025-13881US | — | — | ||
A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endp… | ||||
| CVE-2026-1190US | — | — | ||
A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the… | ||||
showing 20 of 31
02
references
External citations — patches, advisories, analysis.
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan