Reynaldo Immanuel

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw in the OpenID Connect (OIDC) Introspection feature occurs when both realm-level and client-level `notBefore` revocation policies are configured. In this scenario, the system fails to properly honor the realm-level policy, allowing tokens that should have been revoked to remain active. This can lead to unauthorized access or continued session validity. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Auth0 Next.js SDK versions 4.12.0 through 4.17.1 **Description** Simultaneous requests that trigger a nonce retry may cause the proxy cache fetcher to perform improper lookups for token request results. This occurs when projects use the proxy handlers ''/me/*'' and ''/my-org/*'' with DPoP (Demonstrating Proof-of-Possession, a mechanism that binds a token to a private key) enabled. **Recommendations** Update to version 4.18.0.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A security bypass exists in Keycloak where a remote attacker can circumvent security measures by submitting a valid Security Assertion Markup Language (SAML) response from an external Identity Provider (IdP) to the Keycloak SAML endpoint. This occurs during IdP-initiated broker logins, allowing attackers to complete logins even when the SAML Identity Provider is disabled, resulting in unauthorized authentication. The affected API endpoint is the Keycloak SAML endpoint. The vulnerability involves manipulating the SAML response to bypass authentication checks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** An authorization bypass issue exists in the Keycloak Admin API. This allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim’s unique identifier (UUID) and the Organizations feature is enabled. The API endpoint involved is the Keycloak Admin API. The vulnerable parameter is the victim’s unique identifier (`UUID`). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Keycloak (affected versions not specified) **Description** A flaw exists in Keycloak’s invitation token registration mechanism. The server does not verify the cryptographic signature of the JSON Web Token (JWT). An attacker can modify the organization ID (`org id`) and target email within a legitimate invitation token’s JWT payload to register an account in an unauthorized organization. This can lead to unauthorized access, bypassing invite-only onboarding, access to resources through Single Sign-On (SSO), and potential privilege escalation through Role-Based Access Control (RBAC). **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.