VuXML: Keycloak -- multiple vulnerabilities

VuXML ID	a28dd61b-be3e-11f1-bd34-3c7c3fba4204
Discovery	2026-10-01
Entry	2026-10-02

The Keycloak Team reports:

[CVE-2026-12388]: IdP mapper admin role escalation.

[CVE-2026-14781]: OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified.

[CVE-2026-19608]: Name-only group claims let same-name groups satisfy path-specific group policies.

[CVE-2026-54515], [CVE-2026-59889]: Third-party dependency fix, com.fasterxml.jackson.core:jackson-databind 2.22.0.

[CVE-2026-59903]: Third-party dependency fix, io.netty:netty-codec-http:4.1.136.Final.

[source]

CVE Name	CVE-2026-12388
CVE Name	CVE-2026-14781
CVE Name	CVE-2026-19608
CVE Name	CVE-2026-54515
CVE Name	CVE-2026-59889
CVE Name	CVE-2026-59903
URL	https://www.keycloak.org/2026/10/keycloak-2680-released

Keycloak -- multiple vulnerabilities

Details

References