A vulnerability in Apache Kerby allows bypassing the Kerberos pre-authentication check by sending a Pre-Authentication Data (PA-DATA) packet with an unrecognized or unsupported type. This flaw enables attackers to circumvent the initial authentication step, potentially leading to unauthorized access or impersonation within Kerberos-protected environments. The issue affects versions prior to 2.1.2. A fix is available in version 2.1.2.
Apache IoTDB versions from 1.0.0 up to but not including 1.3.6, and from 2.0.0 up to but not including 2.0.7, contain a Path Traversal vulnerability (CWE-22). This flaw allows an attacker to access files outside the intended directory restrictions. The issue is fixed in versions 1.3.6 and 2.0.7. The vulnerability has a high CVSS score of 9.1, indicating critical severity with network attack vector, no privileges required, and no user interaction needed.
Apache IoTDB versions from 1.0.0 before 1.3.6 and from 2.0.0 before 2.0.6 contain a path traversal vulnerability (CVE-2025-55017). This flaw allows an attacker to improperly access restricted directories. The vulnerability is rated critical with a CVSS score of 9.1. Fixed versions 1.3.6 and 2.0.6 address this issue.
Apache Kerby versions prior to 2.1.2 contain a vulnerability in the ASN1 component where processing a deeply nested ASN1 structure can cause a StackOverflowException, leading to denial of service. This issue is fixed in version 2.1.2.
Apicurio Registry versions prior to 3.2.6 and from 3.3.0 up to but not including 3.3.1 contain a vulnerability allowing denial of service via XML entity expansion. An attacker with artifact-write permission can upload crafted XML documents with internal entity-expansion payloads (billion-laughs attack) causing CPU and memory exhaustion. The issue arises because DOCTYPE declarations are not disabled and FEATURE_SECURE_PROCESSING is not enabled, despite blocking external DTD and schema access. The JAXP default entity-expansion limit partially mitigates the impact. A fix is available in versions 3.2.6 and 3.3.1.
A Server-Side Request Forgery (SSRF) vulnerability exists in Apicurio Registry's WSDL processing when the VALIDITY rule is set to FULL. An attacker with Developer-role access can upload a crafted WSDL document containing malicious import locations, causing the registry to make HTTP requests to arbitrary internal URLs. This may allow bypassing access controls and potentially impact confidentiality, integrity, and availability.
A vulnerability in Apicurio Registry's ContentTypeUtil.isParsableXml() method allows attackers with artifact-write permission, or unauthenticated users under default configuration, to upload crafted XML documents that exploit an unhardened SAXParser. This can lead to blind server-side request forgery (SSRF) via external DTD/entity fetch or denial of service (DoS) through entity expansion. The flaw is identified as CWE-611 and affects versions prior to 3.2.6 and versions from 3.3.0 up to but not including 3.3.1. A patch is available in versions 3.2.6 and 3.3.1.
Red Hat build of Keycloak is an integrated sign-on solution,
available as a Red Hat JBoss Middleware for OpenShift containerized
image. The Red Hat build of Keycloak for OpenShift image provides
an authentication server that you can use to log in centrally, log
out, and register. You can also manage user accounts for web
applications, mobile applications, and RESTful web services.
Red Hat build of Keycloak Operator for OpenShift simplifies
deployment and management of Keycloak 26.4.13 clusters.
This erratum releases new images for Red Hat build of Keycloak
26.4.13 for use within the OpenShift Container Platform cloud
computing Platform-as-a-Service (PaaS) for on-premise or private
cloud deployments, aligning with the standalone product release.
Security fixes:
* Information disclosure via CORS header injection due to unvalidated JWT azp claim (CVE-2026-37977)
* Server-Side Request Forgery via OIDC token endpoint manipulation (CVE-2026-4874)
* eclipse-vertx/vert.x:Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860)
* Improper Access Control on Keycloak Server when the account Account API feature is disabled (CVE-2026-7500)
* Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation (CVE-2026-8830)
* Security flaw in org.keycloak/keycloak-services (CVE-2026-8922)
* Information disclosure through arbitrary filesystem path probing (CVE-2026-9083)
* Cross-site scripting (XSS) via case-insensitive URI validation bypass (CVE-2026-9086)
* Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login (CVE-2026-9087)
* Information disclosure due to user profile permission bypass (CVE-2026-9088)
* Group-Admin Escalation to Realm-Admin (CVE-2026-9099)
* Privilege escalation due to oversized subject_token JWT (CVE-2026-9704)
* Attacker can re-enable and take over disabled clients via Registration Access Token (CVE-2026-9705)
* Organization Data Leak After Feature Disabled in Keycloak (CVE-2026-9791)
* Security restriction bypass allows unauthorized ROPC token acquisition (CVE-2026-9792)
* Information disclosure via SAML ECP endpoint (CVE-2026-9794)
* Privilege escalation via improper scope mapping enforcement (CVE-2026-9795)
* Unauthorized access to resources via UMA permission ticket bypass (CVE-2026-9799)
* Authorization bypass via incorrect URI comparison (CVE-2026-9800)
* Denial of Service via malformed LDAP password policy response (CVE-2026-9801)
* Unauthorized account access via replayed refresh tokens after cluster restart (CVE-2026-9802)
* Denial of Service via malformed Authorization header (CVE-2026-9803)
OpenAM Community Edition through version 16.0.6 contains a vulnerability in its RADIUS authentication module that allows unauthenticated attackers to bypass authentication by spoofing Access-Accept responses. This flaw arises from improper verification of cryptographic signatures, enabling attackers to obtain valid OpenAM sessions for any RADIUS username without knowing the shared secret. The issue was patched in version 16.1.1.
A vulnerability in OpenAM Community Edition through version 16.0.6 allows an attacker to forge OAuth2 bearer tokens and OIDC ID tokens with arbitrary attributes by exploiting an authorization bypass through a user-controlled key. The flaw exists in the OAuth2 token-read path, which improperly accepts attacker-controlled tokens from the shared Core Token Store without proper integrity checks. This vulnerability requires the attacker to place malicious JSON data into the token store, which can be triggered via a low-privileged user in a Push Notification-enabled realm. The issue is patched in version 16.1.1.
OpenAM Community Edition through version 16.0.6 contains an unsafe Java deserialization vulnerability in its Push Notification SNS callback resource. The REST endpoint handling SNS push messages allows anonymous access and can deserialize attacker-controlled JSON after fallback to a persistent CTS-stored blob. This flaw enables class-loading and Jackson-based object construction with attacker-controlled data, potentially leading to process execution, file writes, or denial of service depending on the environment. The issue is patched in version 16.1.1.
Apache Shiro versions from 1.2.4 through 2.x and 3.0.0-alpha-1 have a vulnerability in the "remember me" cookie handling where the cookie age is not verified on the server. This flaw allows an attacker who intercepts a valid cookie to reuse it indefinitely, bypassing the configured expiration time. The issue is fixed in Apache Shiro version 3.0.0 and later.
Apache Shiro's shiro-guice module is vulnerable to an authentication bypass when used in a web servlet context. This vulnerability affects all versions from 2.0.0 up to but not including 3.0.0. The issue is similar to CVE-2020-1957 but impacts the shiro-guice module instead of shiro-spring. Upgrading to version 3.0.0 or later resolves the vulnerability.
A deserialization of untrusted data vulnerability (CWE-502) exists in OpenAM's WebAuthn authentication module, affecting versions prior to 16.1.1. Exploitation requires that an attacker can write attacker-controlled data to a storage attribute read by the WebAuthn module, which is not the default configuration but possible in some deployments. Successful exploitation allows arbitrary code execution as the application server user. The issue is patched in OpenAM Community Edition version 16.1.1.
A deserialization vulnerability in jackson-databind's InetSocketAddress handling causes eager DNS resolution during JSON deserialization. This allows an attacker controlling JSON input to trigger outbound DNS lookups at deserialization time, potentially enabling SSRF or DNS-based probing. The issue affects versions before 2.18.8, 2.21.4, and 3.1.4, where it is fixed by deferring DNS resolution until connection time.
OpenAM Community Edition through version 16.0.6 contains an information exposure vulnerability in its Cross-Domain Single Sign-On (CDSSO) servlet. This flaw allows a logged-in user's raw session token to be sent via POST to an attacker-controlled URL if the user is induced to visit a crafted link. The vulnerability requires user interaction and a non-default configuration where CDSSO is enabled. It was fixed in version 16.1.1.
OpenAM Community Edition through version 16.0.6 contains an insufficient authorization and information exposure vulnerability in its session management endpoint. This flaw allows a low-privileged authenticated user to retrieve active session credentials of other users, including those with higher privileges. Exploitation requires a valid low-privilege session and knowledge of the target user's identity. The vulnerability is patched in version 16.1.1.
A reflected cross-site scripting (XSS) vulnerability exists in certain federation endpoints of OpenAM when deployed in a non-default clustered configuration. This occurs due to inconsistent output encoding of user-supplied parameters in HTML responses. The vulnerability affects OpenAM federation library versions prior to 16.1.1 and does not require authentication to exploit. A fix is available in version 16.1.1.
A reflected cross-site scripting (XSS) vulnerability exists in the OAuth 2.0 / OpenID Connect authorization endpoint of OpenAM when using the form_post response mode. The vulnerability arises because certain user-supplied parameters are not properly sanitized before being included in the HTML response. This flaw affects OpenAM versions from 13.0.0 up to but not including 16.1.1. A fix is available in version 16.1.1.