Discussion
CVE-2026-18963: #Keycloak arbitrary account takeover via session confusion using simple HTTP requests. 😱
Nice find and (allegedly) not even AI-powered at its core.
A working exploit is publicly available. Given Keycloak's widespread use in critical auth systems, this appears to be flying a bit under the radar so far.
If you run Keycloak, it needs your attention *now*.
@F30 there has never been a single example of LLMs finding vulnerabilities that cannot be explained as the codebase itself burning a known vuln to force users to update to pull in new and worse vulns
@hipsterelectron What do you mean by "codebase itself burning a known vuln"?
@F30 the codebase backdoors itself for use by intelligence agencies
@hipsterelectron So the codebase itself has agency now?
Install bonfire.cafe
Get the full app experience
