#sso

CVE-2026-120984 and CVE-2026-117691: Code Execution and SAML Account Takeover in Keycloak

Two critical vulnerabilities in Keycloak: a client administrator can execute code on the server via a malicious JavaScript policy, and a SAML signature bypass allows takeover of federated user accounts...