Threats tagged 'cleanstart-2026-nb17779'

A critical security vulnerability in Keycloak involves the jackson-databind library improperly validating the outer class of a class-name type ID while accepting attacker-controlled classes inside generic arguments. This flaw allows an attacker to bypass type restrictions, potentially leading to severe impacts on confidentiality, integrity, and availability. The vulnerability affects Keycloak versions prior to 26.8.1-r1 and has a CVSS score of 9.8. A fix is available in version 26.8.1-r1.