JBoss Keycloak CSRF Vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2014-3709 · ADVISORY
• keycloak/keycloak commit bb132e1 · WEB
• bugzilla.redhat.com/show_bug.cgi · WEB
• issues.jboss.org/browse/KEYCLOAK-765 · WEB
• web.archive.org/web/20200227141715/http://www.securityfocus.com/bid/101508 · WEB
• securityfocus.com/bid/101508 · Third Party Advisory

org.keycloak:keycloak-services のその他の脆弱性

• CVE-2026-18963緊急 9.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access manageme…
• CVE-2026-9800高 8.1A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, includi…
• CVE-2026-9799中 4.6A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one res…
• CVE-2026-9705中 6.5A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token (RAT…
• CVE-2026-9086高 7.3A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access…