Keycloak, Cyrus IMAP, Perl Modules Hit By Multiple Flaws
Keycloak, Cyrus IMAP, and Perl modules face multiple vulnerabilities including auth bypass, memory corruption, and DoS risks.
Multiple vulnerabilities have been disclosed in Keycloak, an open-source identity and access management solution. CVE-2026-16089 allows authorization codes to be retargeted to another client session, potentially leading to unauthorized access. CVE-2026-16093 bypasses required signed-JWT assertion policies by using unsigned assertion headers. Additionally, CVE-2026-16072 exposes organization invitation links, enabling unauthorized member creation. These flaws could impact the security of authentication and authorization processes within Keycloak deployments.
A series of vulnerabilities have been identified in the YAML::Syck module for Perl, affecting versions prior to 1.47. CVE-2026-57076 describes a heap use-after-free vulnerability related to reused anchor names in the syck_hdlr_add_anchor function. CVE-2026-57075 involves an out-of-bounds read in the syck_base64dec function due to improper handling of signed-char lookups. CVE-2026-13713 details a use-after-free and double-free issue when anchor nodes are redefined or removed. Lastly, CVE-2026-57077 points to an out-of-bounds read resulting from an unbounded newline scan in the newline_len function. These vulnerabilities in YAML parsing could lead to memory corruption and potential denial-of-service conditions.
Nine access control and authentication bypass vulnerabilities have been disclosed in Cyrus IMAP through version 3.12.2. As Vypr Intelligence reported, CVE-2026-47085 permits URLAUTH token forgery by bypassing mboxkey checks. CVE-2026-47084 shows the LOCALDELETE command bypassing ACL checks, allowing unauthorized mailbox deletion. CVE-2026-47082 indicates that the vacation feature's "fcc" functionality skips destination-mailbox ACLs, potentially delivering vacation replies to unintended mailboxes. Furthermore, CVE-2026-47089 allows any authenticated user to query LISTRIGHTS on any mailbox, exposing principal access information, and CVE-2026-47088 reveals a heap exposure in nested MIME comment parsing. These vulnerabilities collectively weaken access controls and could expose sensitive information or allow unauthorized actions within Cyrus IMAP.
Several vulnerabilities have been found in XML::Bare for Perl, affecting versions up to 0.53. CVE-2026-57074 describes an unbounded character lookahead in the parserc_parse function, which could lead to issues when parsing specific strings like "<![CDATA" or element terminators. CVE-2026-13401 details an infinite loop vulnerability in parserc_parse when handling malformed attributes, potentially causing a denial-of-service. These parsing flaws could be exploited to disrupt services or potentially lead to unexpected behavior.
A buffer overflow vulnerability exists in aMULE-Project aMule version 2.3.3. CVE-2026-51105 allows a remote attacker to cause a denial of service by sending a specially crafted OP_SERVERMESSAGE Handler. This could disrupt the availability of the aMule network for users.