Red Hat would like to thank yd1ng for reporting this issue.

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client

Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource

Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter

Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions