Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:alpm/archlinux/keycloak@13.0.1-1
purl pkg:alpm/archlinux/keycloak@13.0.1-1
Next non-vulnerable version 14.0.0-1
Latest non-vulnerable version 16.0.0-1
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-j1rd-aem6-vfgj
Aliases:
CVE-2020-35509
GHSA-rpj2-w6fr-79hc
Keycloak vulnerable to Improper Certificate Validation keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity. This issue was partially fixed in version [13.0.1](https://github.com/keycloak/keycloak/pull/6330) and more completely fixed in version [14.0.0](https://github.com/keycloak/keycloak/pull/8067).
14.0.0-1
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-1jc1-3gjk-m3bz Insufficient Session Expiration A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name]. CVE-2021-3461
GHSA-cm29-6wx7-p874

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T18:27:18.202710+00:00 Arch Linux Importer Fixing VCID-1jc1-3gjk-m3bz https://security.archlinux.org/AVG-1994 38.0.0
2026-04-01T18:26:41.444166+00:00 Arch Linux Importer Affected by VCID-j1rd-aem6-vfgj https://security.archlinux.org/AVG-2084 38.0.0