Keycloak

The Keycloak Admin CLI (kcadm) tool fails to properly validate server certificates when a custom truststore is configured, enabling attackers to intercept and compromise administrative credentials via man-in-the-middle attacks.

An authorization bypass vulnerability in the Keycloak UserManagedPermissionService allows authenticated attackers to create policies for resources owned by other users due to insufficient validation of the resourceType field.

A vulnerability in the Keycloak identity-first login flow allows an authenticated attacker belonging to multiple organizations to bypass authentication and perform a full account takeover of a victim.

Keycloak is vulnerable to a denial-of-service condition where an unauthenticated attacker can exhaust disk space by providing arbitrary theme names that trigger persistent on-disk gzip cache creation.

Keycloak versions up to 26.8.1 are vulnerable to privilege escalation where a user with "manage-users" permissions can assign composite roles containing "realm-admin" privileges due to incomplete authorization checks.

A row-count mismatch in Keycloak when using MySQL or MariaDB in stateless mode allows attackers to bypass replay protection for single-use security artifacts like JWT client assertions, DPoP proofs, or TOTP codes.

An unauthenticated denial-of-service vulnerability in Keycloak (CVE-2026-79651) allows attackers to exhaust server memory by injecting arbitrary locale tags into an unbounded cache.

A vulnerability in Keycloak's Dynamic Client Registration component allows authenticated users with an Initial Access Token to forge administrative roles via improper claim validation.

This brief describes how attackers exploit vulnerabilities in web applications to execute suspicious shell commands via web server processes on Linux, enabling persistence, discovery, credential access, and reverse shell establishment, which can lead to full system compromise and data exfiltration.

This rule detects unusual child process executions originating from web server processes on Linux systems, which attackers may use to maintain persistence on a compromised system by exploiting web server vulnerabilities.

Identifies suspicious command executions via a web server on Linux systems, which may suggest a vulnerability and remote shell access.

A vulnerability in Keycloak versions prior to 26.2.14, 26.4.10, and 26.5.5 allows an attacker to cause a breach of data confidentiality and bypass the security policy, as tracked by CVE-2026-2092.

An anonymous, remote attacker can exploit a vulnerability in Keycloak to send arbitrary emails, potentially leading to phishing or social engineering attacks.