BSD PortsKeycloak -- multiple vulnerabilities
· CVE-2026-35563, CVE-2026-16093, CVE-2026-16072, CVE-2026-16108, CVE-2026-16105, CVE-2026-16089, CVE-2026-16104, CVE-2026-16106, CVE-2026-17059, CVE-2026-18218, CVE-2026-18215, CVE-2026-18201, CVE-2026-18209, CVE-2026-18214, CVE-2026-18571, CVE-2026-18572, CVE-2026-18573, CVE-2026-18570, CVE-2026-19729, CVE-2026-79652 · VuXML entry
The Keycloak Team reports: [CVE-2026-35563]: LDAP client implementation in version 2.1.7 does not verify if the server certificate matches the intended LDAP hostname [CVE-2026-16093]: Required signed-JWT assertion policy can be bypassed with unsigned assertion headers [CVE-2026-16072]: Organization managers can create managed members through stored registration links without manage-users [CVE-2026-16108]: Realm …
Affected versions
- keycloak < 26.7.3
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net/keycloak | 26.2.3 | vulnerable since 2026-08-31 | |
| OpenBSD | security/keycloak | 26.7.3 | out of range, by version | |
| NetBSD | wip/py-keycloak | 3.0.0 | not listed | |
| FreeBSD | net/keycloak | 26.8.1 | fixed |