BSD PortsKeycloak -- multiple vulnerabilities
· CVE-2026-12388, CVE-2026-14781, CVE-2026-19608, CVE-2026-54515, CVE-2026-59889, CVE-2026-59903 · VuXML entry
The Keycloak Team reports: [CVE-2026-12388]: IdP mapper admin role escalation. [CVE-2026-14781]: OIDC broker applies id_token email_verified to userinfo email, marking unverified addresses as verified. [CVE-2026-19608]: Name-only group claims let same-name groups satisfy path-specific group policies. [CVE-2026-54515], [CVE-2026-59889]: Third-party dependency fix, com.fasterxml.jackson.core:jackson-databind 2.22.0. …
Affected versions
- keycloak < 26.8.0
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net/keycloak | 26.2.3 | vulnerable since 2026-10-02 | |
| OpenBSD | security/keycloak | 26.7.3 | in range, by version | |
| NetBSD | wip/py-keycloak | 3.0.0 | not listed | |
| FreeBSD | net/keycloak | 26.8.1 | fixed |