CVE-2026-18201 · Brief

CVEs like CVE-2026-18201

The records whose text reads closest to CVE-2026-18201, in the order Forge ranked them. The number on each row is Forge's similarity score. The reason under each row uses held facts only.

1. CVE-2026-30090.732
   Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice…

   Sibling weakness classes under CWE-285, CWE-862 and CWE-863; same vendor or product family, Red.

2. CVE-2026-160720.751
   Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

   Same vendor or product family, Red.

3. CVE-2025-13910.722
   Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims

   Related weakness classes, CWE-284 is above CWE-862; same vendor or product family, Red.

4. CVE-2026-185710.685
   Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

   Same weakness class, CWE-862 (missing authorization); same vendor or product family, Red.

5. CVE-2026-164420.658
   Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

   Same vendor or product family, Red.

6. CVE-2026-15290.685
   Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation…

   Same vendor or product family, Red.

7. CVE-2021-41330.715
   A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user…

   Sibling weakness classes under CWE-285, CWE-862 and CWE-863.

8. CVE-2026-940000.751
   Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership

   Same weakness class, CWE-862 (missing authorization); same vendor or product family, Red.

9. CVE-2026-973110.706
   Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

   Same weakness class, CWE-862 (missing authorization); same vendor or product family, Red.

10. CVE-2026-942150.692
    Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership…

    Same weakness class, CWE-862 (missing authorization); same vendor or product family, Red.

computed Similarity is computed, not recorded. Model Forge pro. Drawn from 396,235 records. Fetched 2026-10-31.