26.6.4
Changed 1
- Upgrade to Quarkus 3.33.2.1
Security 8
- Fix group-admin escalation to realm-admin vulnerability
- Fix information disclosure through arbitrary filesystem path probing vulnerability
- Fix cross-site scripting (XSS) via case-insensitive URI validation bypass vulnerability
- Fix attacker ability to re-enable and take over disabled clients via registration access token
- Fix privilege escalation via improper scope mapping enforcement vulnerability
- Fix unauthorized access to resources via UMA permission ticket bypass vulnerability
- Fix policy enforcer authorization bypass via incorrect URI comparison vulnerability
- Fix authentication bypass via JWT algorithm confusion vulnerability