Exploited: 177
LatestCVE-2026-63471 — fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
VulnFeed.org
AREN
8.1
CVE-2026-11800Fix available

Keycloak has authentication bypass via jwt algorithm confusion

org.keycloak:keycloak-services1 min readRead in
AREN

Summary

### Description A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.

Remediation

References

Esc