VulnSocial

CVE-2026-93999

LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

Back to dashboard
0.0/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 2 mentions across 1 observed day

What's happening

  • 2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d
01122Mentions · 2026-09-19: 209-19
Referenced assets2 URLs
Full discourse2 posts
  • Severity Daily@severitydaily

    Disabling a Keycloak client does not stop its tokens. Refresh keeps minting access tokens that name the disabled client, Red Hat (@RedHat) disclosed today, with two more admin bypasses. No fix yet. https://severitydaily.com/keycloak-cve-2026-93999-disabled-client-refresh-tokens-fgap-admin-bypasses-no-fix/

    0000020
    24 followersView on X
  • CVE@CVEnew

    CVE-2026-93999 A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh pr… https://www.cve.org/CVERecord?id=CVE-2026-93999

    00000841
    58.1K followersView on X

Explore more

Back to dashboard