Created attachment 271495 [details] net/keycloak Upgrade Keycloak to 26.6.3. Tested on 14.3-RELEASE and 15.0-RELEASE. Security: [CVE-2026-4800] lodash vulnerable to Code Injection via `_.template` imports key names account/ui [CVE-2026-4874] Server-Side Request Forgery via OIDC token endpoint manipulation oidc [CVE-2026-37977] CORS Access-Control-Allow-Origin reflected from unverified JWT azp claim on UMA token endpoint authorization-services [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled account/api [CVE-2026-42581] Netty HTTP/1.0 TE+CL Coexistence Bypasses Smuggling Sanitization [CVE-2026-8922] OIDC token introspection ignores realm-level notBefore when client-level notBefore is set oidc [CVE-2026-8830] Missing server-side WebAuthn validations during credential registration authentication/webauthn [CVE-2026-9088] Group Members Endpoint Bypasses User Profile Permissions admin/fine-grained-permissions [CVE-2026-9087] Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login identity-brokering [CVE-2026-9802] Server restart resets startupTime, allowing reuse of rotated refresh tokens when revokeRefreshToken=true oidc [CVE-2026-9794] SAML ECP faultstring discloses client existence and configuration state saml [CVE-2026-9791] Organization data exposed in tokens and account API when Organizations feature is disabled at realm level organizations [CVE-2026-0707] ClientRegistrationAuth DoS via malformed Authorization header (CVE-2026-0707 incomplete fix) admin/api [CVE-2026-9801] DoS in LDAP federation via malformed PasswordPolicyControl ldap [CVE-2026-9704] Privilege escalation via silent subject_token removal in token exchange oidc [CVE-2026-9792] ROPC grant bypass in client policy enforcement oidc
A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=8861c99f200810422ebe8c6403af297b774f5d56 commit 8861c99f200810422ebe8c6403af297b774f5d56 Author: Matthias Wolf <freebsd@rheinwolf.de> AuthorDate: 2026-06-04 21:50:23 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2026-06-04 21:52:25 +0000 net/keycloak: Update 26.6.2 => 26.6.3 (16 CVEs) Release Notes: https://www.keycloak.org/2026/06/keycloak-2663-released PR: 295858 Security: CVE-2026-4800 Security: CVE-2026-4874 Security: CVE-2026-37977 Security: CVE-2026-7500 Security: CVE-2026-42581 Security: CVE-2026-8922 Security: CVE-2026-8830 Security: CVE-2026-9088 Security: CVE-2026-9087 Security: CVE-2026-9802 Security: CVE-2026-9794 Security: CVE-2026-9791 Security: CVE-2026-0707 Security: CVE-2026-9801 Security: CVE-2026-9704 Security: CVE-2026-9792 Sponsored by: UNIS Labs MFH: 2026Q2 net/keycloak/Makefile | 2 +- net/keycloak/distinfo | 6 +- net/keycloak/pkg-plist | 404 ++++++++++++++++++++++++------------------------- 3 files changed, 206 insertions(+), 206 deletions(-)
A commit in branch 2026Q2 references this bug: URL: https://cgit.FreeBSD.org/ports/commit/?id=de64014d05a218347ac29650305d24e93ac24003 commit de64014d05a218347ac29650305d24e93ac24003 Author: Matthias Wolf <freebsd@rheinwolf.de> AuthorDate: 2026-06-04 21:50:23 +0000 Commit: Vladimir Druzenko <vvd@FreeBSD.org> CommitDate: 2026-06-04 21:53:33 +0000 net/keycloak: Update 26.6.2 => 26.6.3 (16 CVEs) Release Notes: https://www.keycloak.org/2026/06/keycloak-2663-released PR: 295858 Security: CVE-2026-4800 Security: CVE-2026-4874 Security: CVE-2026-37977 Security: CVE-2026-7500 Security: CVE-2026-42581 Security: CVE-2026-8922 Security: CVE-2026-8830 Security: CVE-2026-9088 Security: CVE-2026-9087 Security: CVE-2026-9802 Security: CVE-2026-9794 Security: CVE-2026-9791 Security: CVE-2026-0707 Security: CVE-2026-9801 Security: CVE-2026-9704 Security: CVE-2026-9792 Sponsored by: UNIS Labs MFH: 2026Q2 (cherry picked from commit 8861c99f200810422ebe8c6403af297b774f5d56) net/keycloak/Makefile | 2 +- net/keycloak/distinfo | 6 +- net/keycloak/pkg-plist | 404 ++++++++++++++++++++++++------------------------- 3 files changed, 206 insertions(+), 206 deletions(-)
Thanks.