Search for packages
| purl | pkg:maven/org.keycloak/keycloak-services@26.5.5 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-f2hx-5fx3-hmcv
Aliases: CVE-2026-4636 |
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants A flaw was found in Keycloak. An authenticated user with … |
Vulnerable |
|
GHSA-cjm2-j6cm-6p6m
Aliases: CVE-2026-3872 |
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint A flaw was found in Keycloak. This … |
Vulnerable |
|
GHSA-rx66-hj7g-28h7
Aliases: CVE-2026-4325 |
Keycloak: Replay of action tokens via improper handling of single-use entries A flaw was found in Keycloak. The SingleUseObjectProvider, a … |
Vulnerable |
|
GHSA-h4wv-g838-66g3
Aliases: CVE-2026-4634 |
Keycloak: Application-Level DoS via Scope Processing A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by … |
Vulnerable |
|
GHSA-hj93-h7pg-fh6v
Aliases: CVE-2026-4282 |
Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw A flaw was found in Keycloak. The SingleUseObjectProvider, … |
Vulnerable |
|
GHSA-w4p5-rfh6-cwrv
Aliases: CVE-2026-37982 |
Keycloak: Unauthorized account takeover via WebAuthn token replay A flaw was found in Keycloak. This authentication vulnerability allows a remote … |
Vulnerable |
|
GHSA-4x37-hw65-52w8
Aliases: CVE-2026-37979 |
Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass A flaw was found in Keycloak. This access control vulnerability … |
Vulnerable |
|
GHSA-hq3p-w4xv-x7vp
Aliases: CVE-2026-7571 |
Keycloak: Access token disclosure and implicit flow bypass via forged client data A flaw was found in Keycloak. A low-privilege … |
Vulnerable |
|
GHSA-hf67-5vvq-fm3r
Aliases: CVE-2026-7507 |
Keycloak: Session fixation in OIDC login flow that can lead to account takeover A session fixation vulnerability was found in … |
Vulnerable |
|
GHSA-rrv7-3mqf-hxfr
Aliases: CVE-2026-37978 |
Keycloak: Information Disclosure via evaluate-scopes Admin API A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role … |
Vulnerable |
|
GHSA-rp95-xpg9-c2cq
Aliases: CVE-2026-7504 |
Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak A flaw was found in Keycloak's URL validation logic … |
Vulnerable |
|
GHSA-7xf9-4jfc-wgm4
Aliases: CVE-2026-3121 |
Keycloak: manage-clients permission escalates to full realm admin access A flaw was found in Keycloak. An administrator with `manage-clients` permission … |
Vulnerable |
|
GHSA-xh32-c9wx-phrp
Aliases: CVE-2026-3911 |
Keycloak: Information disclosure of disabled user attributes via administrative endpoint A flaw was found in Keycloak. An authenticated user with … | There are no reported fixed by versions. |
|
GHSA-q35r-vvhv-vx5h
Aliases: CVE-2026-3190 |
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure A flaw was found in Keycloak. … |
Vulnerable |
|
GHSA-8g9r-9wjw-37j4
Aliases: CVE-2026-3429 |
Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API A flaw was identified … | There are no reported fixed by versions. |
|
GHSA-hm32-hfmw-rhvg
Aliases: CVE-2026-7500 |
Keycloak has a Forced Browsing issue When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. … | There are no reported fixed by versions. |
|
GHSA-83c4-ffjp-mxp9
Aliases: CVE-2026-8922 |
Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured A flaw was found … | There are no reported fixed by versions. |
|
GHSA-g8vr-x4qh-25qg
Aliases: CVE-2026-8830 |
Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation A flaw was found in Keycloak. An authenticated user … |
Vulnerable Vulnerable |
|
GHSA-m6qj-3mpp-57v8
Aliases: CVE-2026-9087 |
Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromise A flaw was found in Keycloak. … |
Vulnerable Vulnerable |
|
GHSA-c739-f6xw-6pv2
Aliases: CVE-2026-4630 |
Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers Keycloak's Authorization Services feature … |
Vulnerable |
|
GHSA-933f-rg6j-f46p
Aliases: CVE-2026-37981 |
Keycloak Account Resources user lookup contains broken access control Keycloak's Account Resources user lookup endpoint allows a remote authenticated user, … |
Vulnerable |
|
GHSA-v5g5-wwmp-jppw
Aliases: CVE-2026-9802 |
Keycloak has Insufficient Session Expiration A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is … |
Vulnerable |
|
GHSA-8hcx-p7m8-gc28
|
Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-33j3-g875-37rp
Aliases: CVE-2026-9792 |
Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege A flaw was found in Keycloak's Client Policies, specifically within … |
Vulnerable |
|
GHSA-fqjh-8322-vgrv
Aliases: CVE-2026-9794 |
Keycloak Generates an Error Message Containing Sensitive Information A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit … |
Vulnerable |
|
GHSA-rr5q-3xwr-f323
Aliases: CVE-2026-9704 |
Keycloak Vulnerable to Improper Validation of Specified Quantity in Input A flaw was found in Keycloak. An authenticated user with … |
Vulnerable |
|
GHSA-cpf7-j4cf-vqx4
Aliases: CVE-2026-9803 |
Keycloak has an Out-of-bounds Read A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this … |
Vulnerable |
|
GHSA-4q93-v92x-p89f
Aliases: CVE-2026-9791 |
Keycloak Vulnerable to Incorrect Authorization A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit … |
Vulnerable |
|
GHSA-32h4-44jj-c5vx
Aliases: CVE-2026-9795 |
Keycloak has privilege escalation via improper scope mapping enforcement ### Description A flaw was found in Keycloak's Fine-Grained Admin Permissions … |
Vulnerable |
|
GHSA-5v8v-xvjv-57x7
Aliases: CVE-2026-37977 |
Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim A flaw was found in … |
Vulnerable |
|
GHSA-22rm-wp4x-v5cx
Aliases: CVE-2026-4874 |
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation A flaw was found in Keycloak. An authenticated attacker can perform … |
Vulnerable |
|
GHSA-6g26-7cx5-mrrg
Aliases: CVE-2026-9088 |
Keycloak: Information disclosure due to user profile permission bypass A flaw was found in org.keycloak.services. An administrator with delegated access … |
Vulnerable |
|
GHSA-wcvj-vpvw-9rr5
Aliases: CVE-2026-9689 |
Keycloak Services has Improper Validation of Consistency within Input A flaw was found in Keycloak, an open-source identity and access … | There are no reported fixed by versions. |
|
GHSA-p3v8-fm5p-v84h
Aliases: CVE-2026-9793 |
Keycloak has an Improper Verification of Cryptographic Signature issue A flaw was found in Keycloak. When a JSON Web Encryption … | There are no reported fixed by versions. |
|
GHSA-q6h7-xxp7-7429
Aliases: CVE-2026-9798 |
Keycloak has an Authentication Bypass by Primary Weakness A flaw was found in Keycloak, an open-source identity and access management … | There are no reported fixed by versions. |
|
GHSA-4gv3-mc9p-5wqc
Aliases: CVE-2026-18963 |
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass A flaw was found in the reset-credentials flow of the keycloak-services component, … | There are no reported fixed by versions. |
|
GHSA-m32f-8vh9-2hh3
Aliases: CVE-2026-37980 |
Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page A flaw was found in Keycloak, … | There are no reported fixed by versions. |
|
GHSA-4pgc-gfrr-wcmg
Aliases: CVE-2026-4628 |
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false A flaw was found in … | There are no reported fixed by versions. |
|
GHSA-rhgq-f8x5-j2jc
Aliases: CVE-2026-4633 |
Keycloak's identity-first login flow exposes user information A flaw was found in Keycloak. A remote attacker can exploit differential error … |
Vulnerable Vulnerable |
|
GHSA-v3f7-2p4r-mwfw
Aliases: CVE-2026-9086 |
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass ### Description A flaw was found in Keycloak. A … |
Vulnerable |
|
GHSA-w3p3-7cjg-vgfw
Aliases: CVE-2026-9799 |
Keycloak allows unauthorized access to resources via uma permission ticket bypass ### Description A flaw was found in org.keycloak.authorization. An … |
Vulnerable |
|
GHSA-r7rc-c989-86g6
Aliases: CVE-2026-9705 |
Keycloak: Attacker can re-enable and take over disabled clients via registration access token ### Description A flaw was found in … |
Vulnerable |
|
GHSA-9jrw-8xf7-xqhq
Aliases: CVE-2026-9083 |
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing ### Description A flaw was found in Keycloak. A realm … |
Vulnerable |
|
GHSA-f5p5-6xmx-p252
Aliases: CVE-2026-9800 |
Keycloak vulnerable to authorization bypass via incorrect uri comparison ### Description A flaw was found in Keycloak Policy Enforcer. This … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-m297-3jv9-m927
|
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator A security flaw … |
CVE-2026-3009
|
|
GHSA-x4p7-7chp-64hq
|
Keycloak: Unauthorized authentication via disabled SAML Identity Provider A flaw was found in Keycloak. A remote attacker could bypass security … |
CVE-2026-2603
|
|
GHSA-wmxr-6j5f-838p
|
Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions ### Duplicate Advisory This advisory has been withdrawn … | |
|
GHSA-794g-x443-36f7
|
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions Keycloak's SAML broker endpoint does not properly validate encrypted assertions … |
CVE-2026-2092
|