BSD PortsKeycloak -- multiple vulnerabilities
· CVE-2026-9793, CVE-2026-4629, CVE-2026-14209, CVE-2026-14614, CVE-2026-14615 · VuXML entry
The Keycloak Team reports: CVE-2026-9793: JWE request object bypasses requestObjectSignatureAlg enforcement CVE-2026-4629: Privilege escalation via hardcoded role mapper injection in manage-clients CVE-2026-14209: Keycloak Admin UI Extension `brute-force-user` User Disclosure via `search=id:` under FGAP v2 CVE-2026-14614: Keycloak 26.6.3 Fine-Grained Admin Permissions Bypass in Client Scope Assignment …
Affected versions
- keycloak < 26.7.1
By system
1 still vulnerable, 1 fixed. Where VuXML applies (FreeBSD, DragonFly, FreeBSD's derivatives) a port is vulnerable while its version is in a range; pkgsrc says itself whether it lists a CVE of this advisory; OpenBSD and MidnightBSD keep no list this site reads, so their row is only an estimate: FreeBSD's ranges applied to upstream's version.
| System | Port | Version | State | Fixed |
|---|---|---|---|---|
| DragonFly | net/keycloak | 26.2.3 | vulnerable since 2026-08-06 | |
| OpenBSD | security/keycloak | 26.7.3 | out of range, by version | |
| NetBSD | wip/py-keycloak | 3.0.0 | not listed | |
| FreeBSD | net/keycloak | 26.8.1 | fixed |