Bump org.keycloak:keycloak-services from 25.0.2 to 26.7.0 in /bulkfetchuserscustomendpoint

[dependabot]

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[mikroozgurmaden]

Checkmarx One – Scan Summary & Details – 449011d6-1faf-473e-a05f-621fb4c887fc

---

New Issues (18)

Checkmarx found the following issues in this Pull Request

#	Severity	Issue	Source File / Package	Checkmarx Insight
1		CVE-2026-15075	Maven-io.vertx:vertx-core-4.5.28	details Description: In Eclipse Vert.x versions up to and including 4.5.29 (4.x branch) and 5.1.4 (5.x branch), DefaultRedirectHandler (vertx-core) propagates all reque... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
2		CVE-2026-9086	Maven-org.keycloak:keycloak-services-25.0.2	details Description: A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or access to cli... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
3		CVE-2026-9563	Maven-org.eclipse.parsson:parsson-1.1.7	details Recommended version: 1.1.8 Description: In Eclipse Parsson published Maven Central artifacts prior to version 1.1.8, the JSON parser did not enforce a default maximum on the number of cha... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
4		CVE-2026-2575	Maven-org.keycloak:keycloak-services-25.0.2	details Recommended version: 26.0.5.redhat-00003 Description: A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compr... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
5		CVE-2026-37977	Maven-org.keycloak:keycloak-services-25.0.2	details Recommended version: 26.4.13.redhat-00001 Description: A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's Use... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
6		CVE-2026-37979	Maven-org.keycloak:keycloak-services-25.0.2	details Recommended version: 26.0.5.redhat-00003 Description: A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confident... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
7		CVE-2026-45292	Maven-io.opentelemetry:opentelemetry-api-1.57.0	details Recommended version: 1.62.0 Description: opentelemetry-java is the Java implementation of the OpenTelemetry API for recording telemetry, and SDK for managing telemetry recorded by the API.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
8		CVE-2026-54516	Maven-com.fasterxml.jackson.core:jackson-databind-2.21.2	details Recommended version: 2.21.3.redhat-00001 Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 prior to 2.21.4 and... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
9		CVE-2026-54517	Maven-com.fasterxml.jackson.core:jackson-databind-2.21.2	details Recommended version: 2.21.3.redhat-00001 Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
10		CVE-2026-54518	Maven-com.fasterxml.jackson.core:jackson-databind-2.21.2	details Recommended version: 2.21.3.redhat-00001 Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. In versions 2.21.0 prior to 2.2... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
11		CVE-2026-57914	Maven-org.apache.kerby:kerby-asn1-2.0.3	details Recommended version: 2.1.2 Description: By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
12		CVE-2026-59888	Maven-com.fasterxml.jackson.core:jackson-databind-2.21.2	details Recommended version: 2.21.4 Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
13		CVE-2026-59888	Maven-com.fasterxml.jackson.core:jackson-databind-2.17.0	details Recommended version: 2.18.8 Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
14		CVE-2026-59889	Maven-com.fasterxml.jackson.core:jackson-databind-2.21.2	details Recommended version: 2.21.3.redhat-00001 Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21.... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
15		CVE-2026-7500	Maven-org.keycloak:keycloak-services-25.0.2	details Recommended version: 26.6.3 Description: When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the ... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
16		CVE-2026-8830	Maven-org.keycloak:keycloak-services-25.0.2	details Recommended version: 26.4.13.redhat-00001 Description: A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-s... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
17		CVE-2026-8922	Maven-org.keycloak:keycloak-services-25.0.2	details Recommended version: 26.4.13.redhat-00001 Description: A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OID... Attack Vector: NETWORK Attack Complexity: LOW Vulnerable Package
18		CVE-2026-4874	Maven-org.keycloak:keycloak-services-25.0.2	details Recommended version: 26.0.5.redhat-00003 Description: A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` pa... Attack Vector: NETWORK Attack Complexity: HIGH Vulnerable Package

---

Fixed Issues (1)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	Cxeb68d52e-5509	Maven-commons-codec:commons-codec-1.11

---

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR