rootpwn

low · CVSS v3 3.1 · EPSS 0.00202

CVE-2026-94218

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The i…

Description

A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enforces a stronger authentication flow, such as mandatory two-factor authentication (2FA) setup, through a client policy. A user can bypass this requirement by manually visiting a specific session restart web link during the login process. This action clears the internal markers that track the required security steps, allowing the user to log in with only a password and gain access without completing the mandated 2FA setup.

Scores

Severity
low
CVSS v2
2.1
CVSS v3
3.1
CVSS v4
—
EPSS
0.00202

← All CVEs

Related CVEs

low

CVE-2026-92423

The Meow Gallery WordPress plugin before 5.5.5 lacks proper capability checks and user-scoped result filtering when returning post data. This allows authenticated users with Author-level access or higher to view titles, authors, dates, and statuses of other users' draft and private posts. It matters because it can expose unpublished or restricted content metadata on WordPress sites.

View analysis

low

CVE-2026-92965

The TikTok WordPress plugin before 1.4.2 processes sign-in code URLs without verifying that the request is authorized. This can allow unauthenticated visitors to trigger callback actions using the site's TikTok advertising credentials. It matters because it can lead to unauthorized use of the site's ad-platform account.

View analysis

low

CVE-2026-94030

CVE-2026-94030 affects the LibGfx component in SerenityOS, specifically the BMP image loading functionality. An integer overflow vulnerability exists within the `decode_bmp_pixel_data` function when processing the image height. This could potentially lead to unexpected behavior, though exploitability appears limited.

View analysis

low

CVE-2026-86551

The Z80Ultra (NX741J) product contains a vulnerability where non-privileged programs can retrieve the Wi-Fi MAC address by querying the read-only field factory_mac_address in the Settings.Secure database.

View analysis