Поиск уязвимостей
Количество 6
Количество 6
CVE-2026-11800
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.
CVE-2026-11800
A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.
CVE-2026-11800
A flaw was found in Keycloak. This JWT algorithm confusion vulnerabili ...
GHSA-j97h-3f8r-mrjr
Keycloak has authentication bypass via jwt algorithm confusion
ALT-PU-2026-10320
ALT-PU-2026-10320: package `keycloak` update to version 26.6.4-alt1
ALT-PU-2026-10145
ALT-PU-2026-10145: package `keycloak` update to version 26.6.4-alt1
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-11800 A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation. | CVSS3: 8.1 | 0% Низкий | 5 месяцев назад |
 | CVE-2026-11800 A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation. | CVSS3: 8.1 | 0% Низкий | 5 месяцев назад |
| CVE-2026-11800 A flaw was found in Keycloak. This JWT algorithm confusion vulnerabili ... | CVSS3: 8.1 | 0% Низкий | 5 месяцев назад |
| GHSA-j97h-3f8r-mrjr Keycloak has authentication bypass via jwt algorithm confusion | CVSS3: 8.1 | 0% Низкий | 6 дней назад |
| ALT-PU-2026-10320 ALT-PU-2026-10320: package `keycloak` update to version 26.6.4-alt1 | CVSS3: 8.1 | 4 месяца назад | |
| ALT-PU-2026-10145 ALT-PU-2026-10145: package `keycloak` update to version 26.6.4-alt1 | CVSS3: 8.1 | 4 месяца назад |
Уязвимостей на страницу