https://spaceraccoon.github.io/vulnerability-spoiler-alert Vulnerability alerts for keycloak/keycloak en-us Tue, 11 Aug 2026 21:01:38 GMT https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/410 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/410 Tue, 11 Aug 2026 19:18:32 GMT The SCIM filter predicate evaluator allowed filtering Users by 'groups.value' and Groups by 'members.value' without checking whether the caller has FGAP (Fine-Grained Admin Permissions) view authorization on the referenced group/user. This let an admin with restricted group/user visibility use SCIM filter queries (eq, co, sw, pr, ne, etc.) to infer membership in groups or users they are not authorized to view, bypassing the FGAP access model and leaking relationship data as an oracle. The patch adds an authorization callback that verifies VIEW permission on the target group/user before allowing the predicate, and blocks unsafe operators (only 'eq' with a verified target is allowed) as well as NOT-wrapping of authorized predicates to prevent inversion into a membership-leaking oracle. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/409 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/409 Tue, 11 Aug 2026 18:05:17 GMT The SCIM Users API's `groups` attribute exposed organization groups and the organization's internal backing group to callers holding only `view-users`/`manage-users` permissions, bypassing the intended boundary that restricts organization-related groups to the Organization API. This leaked organization membership and group metadata that should not be accessible via SCIM, violating the isolation enforced elsewhere (e.g. the SCIM Groups resource and the SCIM user write path). medium unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/407 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/407 Tue, 11 Aug 2026 16:11:36 GMT Before the patch, the SSF emit endpoint persisted the verbatim caller-supplied event payload (request.getEvent()) into the admin audit event log without sanitization, allowing arbitrary free-form fields and PII (e.g. email addresses, custom sensitive attributes, reason_admin/reason_user localized messages) supplied by a management client to be stored in the admin event store. This could expose PII or sensitive data to anyone with access to admin audit logs, and allowed injection of arbitrary attacker-controlled data into audit records. The patch replaces this with a typed SsfEvent.createAdminDetails() hook that only whitelists specific safe fields (credential_type, change_type, status, reason, etc.), ensuring free-form/PII fields never reach the audit log. medium unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/404 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/404 Tue, 11 Aug 2026 07:33:23 GMT When creating a new user via the admin REST API, group memberships specified in the UserRepresentation were assigned without checking whether the admin had 'manage-membership' permission on the target groups. This allowed an admin with only user-creation privileges (but not group membership management) to add newly created users to arbitrary groups, including groups with elevated privileges, bypassing fine-grained admin permission (FGAP) checks. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/405 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/405 Tue, 11 Aug 2026 07:33:44 GMT Before the patch, a client could supply a claim_token with claims using the reserved 'kc.' prefix (e.g., kc.client.id, kc.realm.name, kc.time.date_time), which would override or spoof server-controlled evaluation context attributes used by authorization policies. Additionally, when both a UMA permission ticket and a claim_token contained claims with the same key, the claim_token value silently overrode the ticket value, allowing a requesting party to override claims that a resource server intentionally set when creating the permission ticket, potentially bypassing intended policy restrictions. high unverified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/402 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/402 Mon, 10 Aug 2026 18:09:35 GMT The searchLDAPByAttributes method used the LDAP_ENTRY_DN attribute value provided as a search parameter directly as the search base DN without validating that it lies within the configured usersDn subtree. This allowed an attacker (e.g. via the Admin REST API searchByAttributes endpoint) to query arbitrary LDAP entries outside the configured user search base, potentially exposing service accounts or other directory objects not meant to be treated as Keycloak users. The patch validates that the provided DN is a descendant of the configured usersDn before using it as the search base, returning an empty stream otherwise. high confirmed CVE-2026-16071 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/401 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/401 Mon, 10 Aug 2026 16:29:05 GMT PathMatcher.matches() performed direct string comparisons against the raw target URI without normalizing matrix parameters, double slashes, dot segments, percent-encoding, or trailing slashes. An attacker could mutate a protected path (e.g. /api/admin) using techniques like matrix params, encoded characters, or path traversal so that it no longer exactly matched the restricted resource pattern but still routed to the same backend resource on the server, causing the request to instead match a permissive catch-all policy (e.g. /*) and bypass intended authorization/deny policies. high confirmed CVE-2026-15573 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/397 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/397 Mon, 10 Aug 2026 12:05:41 GMT The SCIM user schema mapping used `Attributes.nameSet()` to enumerate all user profile attributes for reads and filtering, rather than `getReadable()`, which respects per-attribute view permissions configured in the user profile. This allowed admin-only attributes (e.g., attributes restricted to admin role via UPAttributePermissions) to be exposed and searchable through the SCIM API by users who should not have view access, bypassing the user-profile permission model. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/398 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/398 Mon, 10 Aug 2026 12:05:58 GMT The IdentityBrokerService failed to enforce the linkOnly restriction on the IdP-initiated SSO path, allowing an identity provider configured to only be used for account linking (not standalone login) to still authenticate users directly via SAML IdP-initiated SSO. This bypasses an administrator-configured security restriction meant to prevent an IdP from being used as a primary authentication mechanism, potentially allowing unauthorized login through a broker that was explicitly restricted to link-only usage. high confirmed CVE-2026-16442 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/399 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/399 Mon, 10 Aug 2026 12:06:46 GMT The SearchQueryUtils.getFields() method accessed chars\[i+1\] without checking bounds when encountering a backslash escape character, causing an ArrayIndexOutOfBoundsException if the backslash was the last character in the query. Since this method parses user-supplied search query strings (e.g., admin console user search), a malformed query with a trailing backslash could trigger an unhandled exception, potentially causing a 500 error or disrupting request processing. low verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/386 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/386 Fri, 07 Aug 2026 15:32:10 GMT The Dynamic Client Registration update endpoint allowed a client authenticated only with a Registration Access Token (RAT) - a token scoped to managing that single client's own registration - to change the client's protocol field (e.g., from openid-connect to saml). This let an attacker in possession of an OIDC client's RAT silently convert it into a SAML client, bypassing protocol-specific validations and policies enforced on client type, effectively an unintended privilege/scope escalation. The patch adds a check that rejects any update request containing a different protocol value when the caller authenticated via RAT. medium verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/385 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/385 Fri, 07 Aug 2026 13:33:49 GMT The ProtocolMappersClientRegistrationPolicy only validated new protocol mappers against the allowed provider list, but for existing mappers (identified by ID) it skipped the type check entirely, only comparing configuration. This allowed a client (via Dynamic Client Registration, DCR) to swap an existing allowed mapper's type to a disallowed/dangerous mapper type (e.g., a hardcoded role mapper) while keeping the same mapper ID, bypassing the client registration policy restrictions and potentially escalating privileges via hardcoded roles or claims. high confirmed CVE-2026-15572 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/384 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/384 Fri, 07 Aug 2026 12:06:22 GMT The AccountIssuedVerifiableCredentialResource#delete endpoint deleted issued verifiable credentials by ID using a global lookup (session.users().removeIssuedVerifiableCredential(credentialId)) without verifying that the credential belonged to the authenticated user. Any authenticated user with the manage-account or manage-verifiable-credentials role could delete another user's issued verifiable credential simply by supplying that credential's ID, since the credential ID was not scoped to the requesting user. high verified https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/379 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/379 Thu, 06 Aug 2026 15:36:22 GMT The Micrometer user event metrics listener created a distinct time-series counter for each unique combination of tags, including the 'error' tag (and clientId tag) which is derived from user-controllable input such as arbitrary exception messages or client IDs. An attacker could trigger many different error messages or use many distinct client IDs to generate an unbounded number of unique metric tag values, leading to unbounded memory growth in the metrics registry and potential OOM in Keycloak or downstream observability systems. The patch mitigates this by generifying error codes (e.g., using Errors.GENERIC/INVALID_SCOPE/CLIENT_NOT_FOUND instead of raw exception messages) and adding a MeterFilter that caps the number of distinct tag values (default 10000) for the error and clientId tags, denying new tag values once the limit is reached. medium confirmed CVE-2026-16100 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/362 https://github.com/spaceraccoon/vulnerability-spoiler-alert/issues/362 Tue, 04 Aug 2026 15:08:18 GMT The PatchRequest.setSchemas() method did not handle a null value for the 'schemas' field, allowing an unauthenticated or authenticated attacker to send a SCIM PATCH request with "schemas": null to trigger a NullPointerException on the server, resulting in an unhandled 500 error instead of a proper validation error (400). This could be used for minor denial-of-service or availability disruption of the SCIM PATCH endpoint. low verified