#keycloak

2 articles

Security Alerts Nov 7, 2026

CVE-2026-120984 and CVE-2026-117691: Code Execution and SAML Account Takeover in Keycloak

Two critical vulnerabilities in Keycloak: a client administrator can execute code on the server via a malicious JavaScript policy, and a SAML signature bypass allows takeover of federated user accounts...

Security Alerts Aug 18, 2026

CVE-2026-18963: Account takeover in Keycloak via forced password reset

A flaw in the reset-credentials flow allows forcing a password reset for any user without clicking the verification link, leading to account takeover...