BSD PortsKeycloak -- multiple vulnerabilities
· CVE-2026-15943, CVE-2026-18569, CVE-2026-82968, CVE-2026-94001, CVE-2026-94000, CVE-2026-94218, CVE-2026-94215, CVE-2026-94213, CVE-2026-94217, CVE-2026-96446, CVE-2026-96445, CVE-2026-97177, CVE-2026-95503, CVE-2026-97311, CVE-2026-97846, CVE-2026-101333, CVE-2026-103884, CVE-2026-107121 · VuXML entry
The Keycloak Team reports: [CVE-2026-15943]: OIDC identity provider update reuses masked client secret after token URL changes. [CVE-2026-18569]: OIDC broker backchannel logout accepts unsigned forged logout tokens when signature validation is disabled. [CVE-2026-82968]: Persistent wrong-account linking through null / GitHub identity provider. [CVE-2026-94001]: Admin credential DELETE bypasses denied reset-password …
Affected versions
- keycloak < 26.8.1
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net/keycloak | 26.2.3 | vulnerable since 2026-10-22 | |
| OpenBSD | security/keycloak | 26.7.3 | in range, by version | |
| NetBSD | wip/py-keycloak | 3.0.0 | not listed | |
| FreeBSD | net/keycloak | 26.8.1 | fixed |