Do Son A Keycloak account takeover flaw, CVE-2026-18963, lets attackers reset any user's password with no email verification. Update to 26.7.2 now.
Keycloak
A critical Red Hat vulnerability, CVE-2026-66780 (CVSS 9.9), enables a MITM attack across a cluster mesh. Two more critical flaws disclosed.
Keycloak 26.5.7 fixes an MFA bypass that could let attackers skip two-factor checks. Upgrade your identity server to close the gap.
Apache Camel patches critical flaws in Keycloak (CVE-2026-23552) and LevelDB (CVE-2026-25747) components that allow auth bypass and RCE. Update to 4.18.0.
Learn about the high-severity vulnerability in Keycloak (CVE-2024-3656) that allows unauthorized access to administrative functions.
Uncover the security flaw in Keycloak's SAML signature validation process. Find out how this vulnerability could be exploited by attackers for privilege escalation and user impersonation attacks.