CVE-2025-14777Medium· 6.0▾ SunlitA flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks author…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 33 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
A flaw was found in Keycloak. An IDOR (Broken Access Control) vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer (client) ID provided in the API request, but the backend database lookup and modification operations (findById, delete) only use the resourceId. This mismatch allows an authenticated attacker with fine-grained admin permissions for one client (e.g., Client A) to delete or update resources belonging to another client (Client B) within the same realm by supplying a valid resource ID.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-100351High· 7.4kin-openapi is a Go project for handling OpenAPI files
CVE-2025-13613Critical· 9.8The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2
CVE-2026-104143High· 8.7DataEase is an open source data visualization and analysis tool
CVE-2026-57176Medium· 6.8Python Social Auth is a social authentication/registration mechanism
CVE-2026-95514Medium· 5.3Unauthenticated Bypass Vulnerability in Netgsm <= 2.10.0 versions.
CVE-2026-76183Critical· 9.8Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypassed. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 throug…