Search for packages
| purl | pkg:maven/org.keycloak/keycloak-services@3.4.2.Final |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 10.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-14c3-xa9j-mbab
Aliases: CVE-2021-3513 GHSA-xv7h-95r7-595j |
Incorrect implementation of lockout feature in Keycloak A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality. |
Affected by 60 other vulnerabilities. |
|
VCID-2dgp-xdrz-q7dv
Aliases: GHSA-qj5r-2r5p-phc7 |
Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-m4j5-5x4r-2xp9. This link is maintained to preserve external references. ### Original Description A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks. |
Affected by 9 other vulnerabilities. |
|
VCID-2dgt-7k4f-fyce
Aliases: CVE-2024-2419 GHSA-mrv8-pqfj-7gp5 |
Keycloak path traversal vulnerability in the redirect validation An issue was found in the redirect_uri validation logic that allows for a bypass of otherwise explicitly allowed hosts. |
Affected by 0 other vulnerabilities. Affected by 33 other vulnerabilities. |
|
VCID-2xyb-g3n4-n3ca
Aliases: CVE-2022-1274 GHSA-m4fv-gm5m-4725 GMS-2023-528 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users. |
Affected by 50 other vulnerabilities. |
|
VCID-3248-31p8-tyd4
Aliases: CVE-2020-1725 GHSA-p225-pc2x-4jpm |
Incorrect Authorization A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token. |
Affected by 60 other vulnerabilities. |
|
VCID-3bcu-tbpy-gfg6
Aliases: CVE-2021-20323 GHSA-xpgc-j48j-jwv9 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. |
Affected by 56 other vulnerabilities. |
|
VCID-3sh8-6vsc-1uae
Aliases: CVE-2023-0657 GHSA-7fpj-9hr8-28vh |
Keycloak vulnerable to impersonation via logout token exchange Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions. |
Affected by 0 other vulnerabilities. Affected by 33 other vulnerabilities. |
|
VCID-41hy-n7tz-3bee
Aliases: CVE-2024-3656 GHSA-2cww-fgmg-4jqc |
Keycloak's admin API allows low privilege users to use administrative functions Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. **Acknowledgements:** Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project. |
Affected by 29 other vulnerabilities. |
|
VCID-44rr-5gtu-bfev
Aliases: GHSA-mwm4-5qwr-g9pf GMS-2022-1099 |
Keycloak is vulnerable to IDN homograph attack A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity. |
Affected by 53 other vulnerabilities. |
|
VCID-4p6v-j4up-2ye2
Aliases: CVE-2020-1727 |
keycloak: missing input validation in IDP authorization URLs |
Affected by 70 other vulnerabilities. |
|
VCID-5f8r-n4mm-y3g6
Aliases: CVE-2025-7365 GHSA-xhpr-465j-7p9q |
Keycloak phishing attack via email verification step in first login flow There is a flaw with the first login flow where, during a IdP login, an attacker with a registered account can initiate the process to merge accounts with an existing victim's account. The attacker will subsequently be prompted to "review profile" information, which allows the the attacker to modify their email address to that of a victim's account. This triggers a verification email sent to the victim's email address. If the victim clicks the verification link, the attacker can gain access to the victim's account. While not a zero-interaction attack, the attacker's email address is not directly present in the verification email content, making it a potential phishing opportunity. This issue has been fixed in versions 26.0.13, 26.2.6, and 26.3.0. |
Affected by 0 other vulnerabilities. Affected by 22 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 16 other vulnerabilities. |
|
VCID-5vwq-aqk5-nkh9
Aliases: CVE-2026-1190 GHSA-63v5-26vq-m4vm |
Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationData`. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption. |
Affected by 6 other vulnerabilities. |
|
VCID-5zh4-963a-q3gp
Aliases: CVE-2025-12390 GHSA-rg35-5v25-mqvp |
Keycloak vulnerable to session takeovers due to reuse of session identifiers A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happens because Keycloak sometimes reuses session identifiers and doesn’t clean up properly during logout when browser cookies are missing. As a result, one user may receive tokens that belong to another user. |
Affected by 24 other vulnerabilities. |
|
VCID-6hy1-r23s-cbhy
Aliases: GHSA-vvf8-2h68-9475 |
Duplicate Advisory: Keycloak Open Redirect vulnerability # Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w8gr-xwp4-r9f7. This link is maintained to preserve external references. # Original Description A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking. |
Affected by 25 other vulnerabilities. |
|
VCID-6s4w-hv7a-ffaw
Aliases: CVE-2020-10770 GHSA-jh7q-5mwf-qvhw |
Keycloak vulnerable to Server-Side Request Forgery A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter `request_uri`. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack. |
Affected by 66 other vulnerabilities. |
|
VCID-7c1j-kcbb-v3f1
Aliases: CVE-2026-3911 GHSA-xh32-c9wx-phrp |
Keycloak: Information disclosure of disabled user attributes via administrative endpoint A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes that were configured to be hidden. This unauthorized information disclosure could expose sensitive user data. |
Affected by 5 other vulnerabilities. |
|
VCID-83en-fek9-4qd7
Aliases: CVE-2022-4361 GHSA-3p62-6fjh-3p5h |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri. |
Affected by 47 other vulnerabilities. |
|
VCID-91gs-k267-3kbq
Aliases: CVE-2023-6787 GHSA-c9h6-v78w-52wj |
Keycloak vulnerable to session hijacking via re-authentication A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session. |
Affected by 0 other vulnerabilities. Affected by 33 other vulnerabilities. |
|
VCID-98yf-g4d3-u3g8
Aliases: CVE-2021-3424 GHSA-pf38-cw3p-22q9 |
Keycloak is vulnerable to IDN homograph attack A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges. |
Affected by 53 other vulnerabilities. |
|
VCID-9wzh-7ych-y7c6
Aliases: CVE-2023-6484 GHSA-j628-q885-8gr5 |
Keycloak vulnerable to log Injection during WebAuthn authentication or registration A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection. Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping us improve our security. |
Affected by 0 other vulnerabilities. Affected by 43 other vulnerabilities. |
|
VCID-ajcu-s4zn-63cn
Aliases: CVE-2023-3597 GHSA-4f53-xh3v-g8x4 |
Keycloak secondary factor bypass in step-up authentication Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication. |
Affected by 0 other vulnerabilities. Affected by 33 other vulnerabilities. |
|
VCID-bhrr-nn9f-7udu
Aliases: GHSA-fx44-2wx5-5fvp |
Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass # Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5jfq-x6xp-7rw2. This link is maintained to preserve external references. # Original Description A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication. |
Affected by 18 other vulnerabilities. |
|
VCID-by72-dvnw-m3gu
Aliases: CVE-2025-2559 GHSA-2935-2wfm-hhpv |
Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This issue could result in a denial of service condition, preventing legitimate users from accessing the system. |
Affected by 20 other vulnerabilities. |
|
VCID-cdsa-wmby-ebbq
Aliases: GHSA-r934-w73g-v4p8 |
Duplicate Advisory: Keycloak hostname verification # Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hw58-3793-42gg. This link is maintained to preserve external references. # Original Description A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended. |
Affected by 18 other vulnerabilities. |
|
VCID-cgf7-vbkd-cua6
Aliases: CVE-2021-3754 GHSA-4vc8-pg5c-vg4x |
Keycloak's improper input validation allows using email as username Keycloak allows the use of email as a username and doesn't check that an account with this email already exists. That could lead to the unability to reset/login with email for the user. This is caused by usernames being evaluated before emails. |
Affected by 41 other vulnerabilities. |
|
VCID-d2rd-6u56-yfd8
Aliases: CVE-2025-3910 GHSA-5jfq-x6xp-7rw2 |
Keycloak vulnerable to two factor authentication bypass # Description A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication. |
Affected by 18 other vulnerabilities. |
|
VCID-d6ku-ys87-cqh4
Aliases: CVE-2024-8883 GHSA-w8gr-xwp4-r9f7 |
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking. |
Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 25 other vulnerabilities. |
|
VCID-djwn-hkwg-g3gk
Aliases: CVE-2020-14302 |
keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks |
Affected by 60 other vulnerabilities. |
|
VCID-dxj3-8sk5-mfdy
Aliases: CVE-2022-3916 GHSA-97g8-xfvw-q4hg GMS-2022-8406 |
Insufficient Session Expiration A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user. |
Affected by 52 other vulnerabilities. |
|
VCID-e4ub-v4ef-affb
Aliases: CVE-2025-3501 GHSA-hw58-3793-42gg |
Keycloak hostname verification A flaw was found in Keycloak. By setting a verification policy to 'ANY', the trust store certificate verification is skipped, which is unintended. |
Affected by 18 other vulnerabilities. |
|
VCID-e9qa-sy57-fqby
Aliases: CVE-2021-20202 GHSA-6xp6-fmc8-pmmr |
Temporary Directory Hijacking Vulnerability in Keycloak A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions, allowing the attacker to have access to the contents that keycloak stores in this directory. The highest threat from this vulnerability is to data confidentiality and integrity. |
Affected by 60 other vulnerabilities. |
|
VCID-em5z-nvqy-fucp
Aliases: CVE-2021-3856 GHSA-3w4v-rvc4-2xpw |
Keycloak has Files or Directories Accessible to External Parties ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available. |
Affected by 58 other vulnerabilities. |
|
VCID-engr-q4ge-53dc
Aliases: CVE-2023-6134 GHSA-cvg2-7c3j-g36j |
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748. |
Affected by 46 other vulnerabilities. Affected by 44 other vulnerabilities. |
|
VCID-ezqk-pyhr-5ffj
Aliases: CVE-2024-7341 GHSA-5rxp-2rhr-qwqv |
Keycloak has session fixation in Elytron SAML adapters A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 27 other vulnerabilities. |
|
VCID-gjy5-c6by-2ufg
Aliases: CVE-2020-1744 GHSA-4gf2-xv97-63m2 |
Improper Handling of Exceptional Conditions A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events. |
Affected by 70 other vulnerabilities. |
|
VCID-gndk-728r-9yh7
Aliases: CVE-2021-3632 GHSA-qpq9-jpv4-6gwr |
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any user by using the WebAuthn password-less login flow. |
Affected by 58 other vulnerabilities. |
|
VCID-gnxr-2t9g-4ye4
Aliases: CVE-2025-8419 GHSA-m4j5-5x4r-2xp9 |
Keycloak SMTP Inject Vulnerability Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64 characters (limited local part of the email), so the attack is limited to very shorts emails (subject and little data, the example is 60 chars). This flaw's only direct consequence is an unsolicited email being sent from the Keycloak server. However, this action could be a precursor for more sophisticated attacks. |
Affected by 0 other vulnerabilities. Affected by 9 other vulnerabilities. |
|
VCID-gzz6-md9v-b3em
Aliases: CVE-2026-3009 GHSA-m297-3jv9-m927 |
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider. |
Affected by 5 other vulnerabilities. |
|
VCID-htax-rbrs-mbdu
Aliases: CVE-2024-1722 GHSA-cq42-vhv7-xr7p |
Keycloak Denial of Service via account lockout In any realm set with "User (Self) registration" a user that is registered with a username in email format can be "locked out" (denied from logging in) using his username. |
Affected by 42 other vulnerabilities. |
|
VCID-j4ar-u2rr-qkfu
Aliases: CVE-2024-4540 GHSA-69fp-7c8p-crjr |
Keycloak exposes sensitive information in Pushed Authorization Requests (PAR) A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests (PAR). Client provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a request_uri authorization request. This could lead to an information disclosure vulnerability. |
Affected by 29 other vulnerabilities. |
|
VCID-jh5h-pp29-1kbr
Aliases: CVE-2023-2585 GHSA-f5h4-wmp5-xhg6 |
Client Spoofing within the Keycloak Device Authorisation Grant Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients. |
Affected by 47 other vulnerabilities. |
|
VCID-ju1d-vwgb-bqbn
Aliases: CVE-2023-6544 GHSA-46c8-635v-68r2 |
Keycloak Authorization Bypass vulnerability Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized. #### Acknowledgements: Special thanks to Bastian Kanbach for reporting this issue and helping us improve our security. |
Affected by 0 other vulnerabilities. Affected by 33 other vulnerabilities. |
|
VCID-kzc8-pgz7-6bep
Aliases: CVE-2020-1724 GHSA-8xj2-47xw-q78c |
Keycloak Insufficient Session Expiry A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section. |
Affected by 70 other vulnerabilities. |
|
VCID-m3uj-4mag-kbf2
Aliases: CVE-2026-2733 GHSA-fjf4-6f34-w64q |
Keycloak: Missing Check on Disabled Client for Docker Registry Protocol A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting to OFF does not fully prevent access. As a result, previously valid credentials can still be used to obtain authentication tokens. This weakens administrative controls and could allow unintended access to container registry resources. |
Affected by 4 other vulnerabilities. |
|
VCID-mku9-3bpp-aqbk
Aliases: GHSA-83j7-mhw9-388w |
Duplicate Advisory: Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled) ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gp-8389-hm4w. This link is maintained to preserve external references. ### Original Description A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions (FGAPv2) are enabled. An administrative user with the manage-users role can escalate their privileges to realm-admin due to improper privilege enforcement. This vulnerability allows unauthorized elevation of access rights, compromising the intended separation of administrative duties and posing a security risk to the realm. |
Affected by 11 other vulnerabilities. |
|
VCID-n76a-pfh2-57bn
Aliases: GHSA-8wm9-24qg-m5qj |
Duplicate Advisory: Keycloak has a brute force login protection bypass ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-gc7q-jgjv-vjr2. This link is maintained to preserve external references. ## Original Description A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. This timing loophole enables attackers to make more guesses at passwords than intended, potentially compromising account security on affected systems. |
Affected by 32 other vulnerabilities. |
|
VCID-nhe2-8dtq-gqbf
Aliases: CVE-2023-6291 GHSA-mpwq-j3xf-7m5w |
URL Redirection to Untrusted Site ('Open Redirect') A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users. |
Affected by 46 other vulnerabilities. Affected by 44 other vulnerabilities. |
|
VCID-nxhc-rp71-hbdk
Aliases: GHSA-gj52-35xm-gxjh |
Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xhpr-465j-7p9q. This link is maintained to preserve external references. ### Original Description A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email address to match that of a victim's account, triggering a verification email sent to the victim's email address. The attacker's email address is not present in the verification email content, making it a potential phishing opportunity. If the victim clicks the verification link, the attacker can gain access to the victim's account. |
Affected by 16 other vulnerabilities. |
|
VCID-pjgz-fa5h-tkfh
Aliases: CVE-2024-10270 GHSA-wq8x-cg39-8mrr |
org.keycloak:keycloak-services has Inefficient Regular Expression Complexity A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity. |
Affected by 0 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-qexf-7axp-9kas
Aliases: CVE-2018-10894 GHSA-xvv8-8wh9-9fh2 |
Improper Certificate Validation It was found that SAML authentication in Keycloak incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks. |
Affected by 72 other vulnerabilities. |
|
VCID-qgbq-s33g-d7af
Aliases: CVE-2026-3429 GHSA-8g9r-9wjw-37j4 |
Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication. |
Affected by 2 other vulnerabilities. |
|
VCID-r5g8-gcss-zuh4
Aliases: CVE-2023-2422 GHSA-3qh5-qqj2-c78f |
Keycloak vulnerable to Improper Client Certificate Validation for OAuth/OpenID clients When a Keycloak server is configured to support mTLS authentication for OAuth/OpenID clients, it does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client and therefore access data that belongs to other clients. |
Affected by 47 other vulnerabilities. |
|
VCID-rrkd-31d4-9yaq
Aliases: CVE-2022-2232 GHSA-8hc5-rmgf-qx6p |
Keycloak vulnerable to LDAP Injection on UsernameForm Login A flaw was found in the Keycloak package. This flaw allows an attacker to benefit from an LDAP query and access existing usernames in the server. |
Affected by 44 other vulnerabilities. |
|
VCID-rssz-yqj9-b7h8
Aliases: CVE-2020-14366 GHSA-cp67-8w3w-6h9c |
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw |
Affected by 68 other vulnerabilities. |
|
VCID-scdf-8m3d-vqff
Aliases: CVE-2022-1245 GHSA-75p6-52g3-rqc8 GMS-2022-1039 |
Duplicate This advisory duplicates another. |
Affected by 53 other vulnerabilities. |
|
VCID-sgbm-r5mm-sbbx
Aliases: CVE-2024-1132 GHSA-72vp-xfrc-42xm |
Keycloak path traversal vulnerability in redirection validation A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field. #### Acknowledgements: Special thanks to Axel Flamcourt for reporting this issue and helping us improve our project. |
Affected by 0 other vulnerabilities. Affected by 33 other vulnerabilities. |
|
VCID-sk6p-vfu6-7kem
Aliases: CVE-2020-10776 GHSA-484q-784p-8m5h |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack. |
Affected by 68 other vulnerabilities. |
|
VCID-th5p-51pd-3ffg
Aliases: CVE-2020-14389 GHSA-c9x9-xv66-xp3v |
Improper privilege management in Keycloak A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission. |
Affected by 68 other vulnerabilities. |
|
VCID-u5ba-kpd5-67bm
Aliases: CVE-2020-27838 GHSA-pcv5-m2wh-66j3 |
Keycloak discloses information without authentication A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality. |
Affected by 60 other vulnerabilities. |
|
VCID-uuf2-u7xh-uuef
Aliases: CVE-2025-12110 GHSA-895x-rfqp-jh5c |
Keycloak does not invalidate offline sessions when the offline_access scope is removed A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted and you can continue to request new tokens for the session. As it can lead to a situation where an administrator removes the scope, and assumes that offline sessions are no longer available, but they are. |
Affected by 17 other vulnerabilities. |
|
VCID-v7r6-3873-77dc
Aliases: GHSA-4vrx-8phj-x3mg |
Duplicate Advisory: Keycloak exposes sensitive information in Pushed Authorization Requests (PAR) ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-69fp-7c8p-crjr. This link is maintained to preserve external references. ## Original Description A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization request, possibly leading to an information disclosure vulnerability. |
Affected by 29 other vulnerabilities. |
|
VCID-ver5-9t6m-c3ef
Aliases: CVE-2025-14083 GHSA-594w-2fwp-jwrc |
Keycloak Admin REST API exposes backend schema and rules A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control. |
Affected by 16 other vulnerabilities. |
|
VCID-vstv-ec14-quc5
Aliases: GHSA-j3x3-r585-4qhg |
Duplicate Advisory: org.keycloak:keycloak-services has Inefficient Regular Expression Complexity ## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wq8x-cg39-8mrr. This link is maintained to preserve external references. ## Original Description A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity. |
Affected by 0 other vulnerabilities. Affected by 22 other vulnerabilities. |
|
VCID-w5f1-xryr-fucq
Aliases: CVE-2026-1035 GHSA-m2w5-7xhv-w6fh |
Keycloak does not validate and update refresh token usage atomically A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. This allows concurrent refresh requests to bypass single-use enforcement and issue multiple access tokens from the same refresh token. As a result, Keycloak’s refresh token rotation hardening can be undermined. |
Affected by 16 other vulnerabilities. |
|
VCID-whsx-d6an-hkdm
Aliases: CVE-2023-6717 GHSA-8rmm-gm28-pj8q |
Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL (ACS), including JavaScript URIs (javascript:). Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission. #### Acknowledgements: Special thanks to Lauritz Holtmann for reporting this issue and helping us improve our project. |
Affected by 0 other vulnerabilities. Affected by 33 other vulnerabilities. |
|
VCID-x4aw-v76q-vbdc
Aliases: CVE-2025-12150 GHSA-7g5x-9c4v-4w5r |
Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration. |
Affected by 8 other vulnerabilities. |
|
VCID-xd7x-aevv-cfcp
Aliases: CVE-2026-2575 GHSA-xv6h-r36f-3gp5 |
Keycloak: Denial of Service due to excessive SAMLRequest decompression A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service. |
Affected by 4 other vulnerabilities. |
|
VCID-xdxx-tdkj-wbba
Aliases: CVE-2020-1758 GHSA-c597-f74m-jgc2 |
Improper Certificate Validation A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack. |
Affected by 69 other vulnerabilities. |
|
VCID-xfnw-15sz-zyfr
Aliases: CVE-2025-14082 GHSA-6q37-7866-h27j |
Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions A flaw was found in Keycloak Admin REST (Representational State Transfer) API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/{realm}/roles endpoint. |
Affected by 14 other vulnerabilities. |
|
VCID-xy58-u3se-wfdb
Aliases: CVE-2023-0264 GHSA-9g98-5mj6-f9mv GMS-2023-573 |
Keycloak vulnerable to user impersonation via stolen UUID code Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session tokens. |
Affected by 52 other vulnerabilities. Affected by 50 other vulnerabilities. |
|
VCID-y1h3-yyn9-53fr
Aliases: CVE-2026-2603 GHSA-x4p7-7chp-64hq |
Keycloak: Unauthorized authentication via disabled SAML Identity Provider A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacker to complete broker logins even when the SAML Identity Provider is disabled, leading to unauthorized authentication. |
Affected by 2 other vulnerabilities. |
|
VCID-ysyw-rgyv-bkhj
Aliases: CVE-2024-4629 GHSA-gc7q-jgjv-vjr2 |
Keycloak Services has a potential bypass of brute force protection If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user. **Acknowledgements:** Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 28 other vulnerabilities. |
|
VCID-z2bw-n4x2-a7gj
Aliases: CVE-2024-1249 GHSA-m6q9-p373-g5q8 |
Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages. #### Acknowledgements Special thanks to Adriano Márcio Monteiro from BRZTEC for reporting this issue and helping us improve our project. |
Affected by 0 other vulnerabilities. Affected by 33 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||