CVE-2026-15571: Predictable Account-Linking Hash in Keycloak
A predictable account-linking hash in Keycloak could enable account takeover via a malicious OpenID Connect client. Fixed in version 26.7.2.
Tag: account takeover
Critical Keycloak Flaw CVE-2026-18963 Allows Unauthenticated Account Takeover
Red Hat and the Keycloak project have released patches for a critical vulnerability, CVE-2026-18963, that could let unauthenticated attackers take over any…
CTM360 Uncovers 3,000+ Recruitment Phishing URLs Using Browser-in-the-Browser Credential Traps
Cybersecurity researchers at CTM360 have exposed a large-scale, global recruitment-themed phishing campaign that leverages Browser-in-the-Browser (BitB) windows to steal Google and Facebook…
Facebook Credentials Targeted in RecruitTrap Phishing
The RecruitTrap campaign also targets Facebook credentials through fake authentication popups, enabling account takeover and potential access to advertising platforms.
N-able Releases N-central Hotfix 2 as Attackers Exploit CVE-2026-18577 to Persist via Cloudflare Tunnel
N-able has issued Hotfix 2 for its N-central Remote Monitoring and Management (RMM) product, responding to ongoing exploitation of a recently disclosed…
CISA Adds Actively Exploited N-able N-central Authentication Bypass CVE-2026-18577 to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability affecting N-able N-central to its Known Exploited Vulnerabilities (KEV)…
NodeBB Patches Eight AI-Found Flaws Exposing Admin Access and Private Chats
Eight security flaws in NodeBB were disclosed on July 24, 2026, along with exploit code. Discovered by Aikido Security's AI pentest agents…
CVE-2026-58593: NodeBB Federation Flaw Allows Account Takeover
A separate NodeBB federation vulnerability, CVE-2026-58593, filed on July 1, 2026, allows an outside server to post and send messages in the…
n8n Token Exchange Flaw CVE-2026-59208 Enables Account Takeover via JWT Sub Claim Mismatch
A critical vulnerability in n8n's Enterprise token exchange feature, tracked as CVE-2026-59208, allows attackers to log in as any user by exploiting…
Zoom Patches Critical Windows Flaw That Could Enable Account Takeover
Zoom has released security updates for a critical security flaw impacting Zoom Workplace for Windows that could facilitate account takeover. The vulnerability,…