Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.keycloak/keycloak-core@9.0.1
purl pkg:maven/org.keycloak/keycloak-core@9.0.1
Tags Ghost
Next non-vulnerable version 26.1.3
Latest non-vulnerable version 26.1.3
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-255g-p3tj-k7fk
Aliases:
CVE-2020-10686
GHSA-9695-w6h2-jpv9
Keycloak users may be able to remove MFA from other users' devices A community-only flaw was found where a malicious user can register himself and then uses the "remove devices" form to post different credential ids with the hope of removing MFA devices for other users.
9.0.2
Affected by 33 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-04T14:32:34.020724+00:00 GHSA Importer Affected by VCID-255g-p3tj-k7fk https://github.com/advisories/GHSA-9695-w6h2-jpv9 38.1.0
2026-04-02T16:58:13.644016+00:00 GHSA Importer Fixing VCID-gjy5-c6by-2ufg https://github.com/advisories/GHSA-4gf2-xv97-63m2 38.1.0
2026-04-01T13:00:55.854648+00:00 GithubOSV Importer Fixing VCID-gjy5-c6by-2ufg https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-4gf2-xv97-63m2/GHSA-4gf2-xv97-63m2.json 38.0.0
2026-04-01T12:48:51.653446+00:00 GitLab Importer Fixing VCID-gjy5-c6by-2ufg https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.keycloak/keycloak-core/CVE-2020-1744.yml 38.0.0