https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-97175/https://vulnfeed.org/cve/CVE-2026-97175/Thu, 05 Nov 2026 18:17:11 +0000A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based on an email address without verifying if the provider has validated that email. This can allow an attacker to take over a victim's account by using a matching unverified email address at a brokered provider.https://vulnfeed.org/cve/CVE-2026-97847/https://vulnfeed.org/cve/CVE-2026-97847/Thu, 05 Nov 2026 18:17:11 +0000A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session ID, Keycloak may incorrectly resolve the token bearer as a different, highly privileged user based on the manipulated claims. This can allow an attacker with limited client management permissions to impersonate a realm administrator and gain full control over the realm.https://vulnfeed.org/cve/CVE-2026-92855/https://vulnfeed.org/cve/CVE-2026-92855/Thu, 05 Nov 2026 18:17:10 +0000A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.https://vulnfeed.org/cve/CVE-2026-92857/https://vulnfeed.org/cve/CVE-2026-92857/Thu, 05 Nov 2026 18:17:10 +0000Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.https://vulnfeed.org/cve/CVE-2026-82965/https://vulnfeed.org/cve/CVE-2026-82965/Thu, 05 Nov 2026 17:18:21 +0000A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.https://vulnfeed.org/cve/CVE-2026-114232/https://vulnfeed.org/cve/CVE-2026-114232/Thu, 05 Nov 2026 17:17:39 +0000A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.https://vulnfeed.org/cve/CVE-2026-112208/https://vulnfeed.org/cve/CVE-2026-112208/Thu, 05 Nov 2026 17:17:38 +0000A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.https://vulnfeed.org/cve/CVE-2026-110931/https://vulnfeed.org/cve/CVE-2026-110931/Thu, 05 Nov 2026 17:17:37 +0000A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.https://vulnfeed.org/cve/CVE-2026-110932/https://vulnfeed.org/cve/CVE-2026-110932/Thu, 05 Nov 2026 17:17:37 +0000A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.https://vulnfeed.org/cve/CVE-2026-107602/https://vulnfeed.org/cve/CVE-2026-107602/Thu, 05 Nov 2026 17:17:35 +0000A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.https://vulnfeed.org/cve/CVE-2026-107123/https://vulnfeed.org/cve/CVE-2026-107123/Thu, 05 Nov 2026 17:17:34 +0000A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.https://vulnfeed.org/cve/CVE-2026-103112/https://vulnfeed.org/cve/CVE-2026-103112/Thu, 05 Nov 2026 17:17:32 +0000A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.https://vulnfeed.org/cve/CVE-2026-117691/https://vulnfeed.org/cve/CVE-2026-117691/Thu, 05 Nov 2026 13:27:23 +0000A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An attacker can use this discrepancy to provide a crafted, unsigned SAML message that the server processes instead of a legitimately signed one, leading to full account takeover of federated users.