Keycloak

An authenticated attacker with client management permissions can exploit a session attribute flaw in Keycloak to upload and execute arbitrary JavaScript policies on the server.

A vulnerability in Keycloak’s protocol mapper and identity resolution components allows an attacker with limited client management permissions to escalate privileges to realm administrator by manipulating identity claims in sessionless service-account tokens.

A flaw in Keycloak’s idp-auto-link authenticator allows attackers to perform account takeover by linking external identities to local accounts using unverified email addresses.

An authorization bypass vulnerability in the Keycloak UserManagedPermissionService allows authenticated attackers to create policies for resources owned by other users due to insufficient validation of the resourceType field.

A vulnerability in the Keycloak identity-first login flow allows an authenticated attacker belonging to multiple organizations to bypass authentication and perform a full account takeover of a victim.

Keycloak is vulnerable to a denial-of-service condition where an unauthenticated attacker can exhaust disk space by providing arbitrary theme names that trigger persistent on-disk gzip cache creation.

An unauthenticated remote attacker can cause a denial of service in Keycloak by sending crafted SAML requests with malicious dateTime or duration values that trigger excessive CPU consumption.

A flaw in Keycloak's SAML HTTP-Redirect binding implementation allows an attacker to bypass signature verification using percent-encoded parameter names, potentially leading to full account takeover of federated users.

A vulnerability in Keycloak allows a remote, authenticated attacker to perform a privilege escalation to gain administrator access.

An unauthenticated denial-of-service vulnerability in Keycloak (CVE-2026-79651) allows attackers to exhaust server memory by injecting arbitrary locale tags into an unbounded cache.

An unauthenticated attacker can trigger a denial of service in Keycloak by sending repeated malformed SAML requests that cause native memory exhaustion due to improper zlib memory management.

Keycloak suffers from a vulnerability in its legacy client-initiated account-linking endpoint where predictable hashes allow attackers to forge linking URLs, facilitating unauthorized account takeover.

A vulnerability in Keycloak's Dynamic Client Registration component allows authenticated users with an Initial Access Token to forge administrative roles via improper claim validation.

This detection rule identifies suspicious child process executions originating from web server processes on Linux systems, indicating that attackers may have exploited web application vulnerabilities such as command injection or remote file inclusion to establish persistence or execute malicious commands.

This brief details how attackers exploit vulnerable web applications or deploy webshells on Linux systems to achieve persistence by executing unusual shell commands from web server processes, potentially leading to payload downloads, reverse shells, or cron-like task implants.

This brief describes how attackers exploit vulnerabilities in web applications to execute suspicious shell commands via web server processes on Linux, enabling persistence, discovery, credential access, and reverse shell establishment, which can lead to full system compromise and data exfiltration.

A vulnerability exists in Keycloak when its JSON Web Token (JWT) authorization grant preview feature is enabled, allowing a remote attacker with low privileges to exploit CVE-2026-1609 by presenting a valid assertion token from an external identity provider to obtain a JWT for a user account that has been disabled, thereby bypassing access controls and gaining unauthorized access to sensitive resources.

This rule detects unusual child process executions originating from web server processes on Linux systems, which attackers may use to maintain persistence on a compromised system by exploiting web server vulnerabilities.

Identifies suspicious command executions via a web server on Linux systems, which may suggest a vulnerability and remote shell access.

CVE-2026-7571 describes a vulnerability in Keycloak where a low-privilege user can bypass security controls intended to disable the implicit flow in OpenID Connect (OIDC) clients by manipulating client data during session restart, potentially exposing access tokens.

A session fixation vulnerability in Keycloak's /login-actions/restart endpoint allows an unauthenticated attacker to hijack a user's session by crafting a malicious link that resets the authentication flow, potentially leading to account takeover.

A vulnerability in Keycloak's URL validation allows attackers to redirect users to unauthorized URLs by exploiting discrepancies in the handling of the user-info component within URLs, potentially leading to sensitive information exposure.

An authenticated remote attacker can exploit a vulnerability in Keycloak to bypass security measures.

An anonymous, remote attacker can exploit a vulnerability in Keycloak to send arbitrary emails, potentially leading to phishing or social engineering attacks.