Search for packages
| purl | pkg:maven/org.keycloak/keycloak-server-spi-private@11.0.3 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-484q-784p-8m5h
Aliases: CVE-2020-10776 |
Cross-site Scripting in keycloak A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe … |
Vulnerable |
|
GHSA-f5h4-wmp5-xhg6
Aliases: CVE-2023-2585 |
Client Spoofing within the Keycloak Device Authorisation Grant Under certain pre-conditions the vulnerability allows an attacker to spoof parts of … |
Vulnerable |
|
GHSA-v4jw-m6rm-399h
Aliases: CVE-2026-0871 |
Keycloak Server Private SPI: Improper Access Control Allows Administrators to Bypass Attribute Visibility Restrictions and Modify Unmanaged User Profile Attributes … |
Vulnerable |
|
GHSA-q35r-vvhv-vx5h
Aliases: CVE-2026-3190 |
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure A flaw was found in Keycloak. … |
Vulnerable |
|
GHSA-x4p7-7chp-64hq
Aliases: CVE-2026-2603 |
Keycloak: Unauthorized authentication via disabled SAML Identity Provider A flaw was found in Keycloak. A remote attacker could bypass security … |
Vulnerable |
|
CVE-2020-1725
|
Exposure of Resource to Wrong Sphere A flaw was found in keycloak In some scenarios a user still has access … |
Vulnerable |
|
CVE-2023-6291
|
URL Redirection to Untrusted Site ('Open Redirect') A flaw was found in the redirect_uri validation logic in Keycloak. This issue … |
Vulnerable |
|
CVE-2020-27838
|
Improper Authentication A flaw was found in keycloak The client registration endpoint allows fetching information about PUBLIC clients (like client … | There are no reported fixed by versions. |
|
CVE-2021-20222
|
Improper Input Validation The new account console in keycloak can allow malicious code to be executed using the referrer URL. … |
Vulnerable |
|
CVE-2022-3916
|
Insufficient Session Expiration A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared … |
Vulnerable |
|
GHSA-rr5q-3xwr-f323
Aliases: CVE-2026-9704 |
Keycloak Vulnerable to Improper Validation of Specified Quantity in Input A flaw was found in Keycloak. An authenticated user with … |
Not vulnerable |
|
GHSA-4q93-v92x-p89f
Aliases: CVE-2026-9791 |
Keycloak Vulnerable to Incorrect Authorization A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit … | There are no reported fixed by versions. |
|
CVE-2020-10770
|
Server-Side Request Forgery (SSRF) A flaw was found in Keycloak, where it is possible to force the server to call … |
Vulnerable Vulnerable |
|
CVE-2020-14389
|
Improper Privilege Management It was found that Keycloak would permit a user with only view-profile role to manage the resources … |
Vulnerable Vulnerable |
|
CVE-2020-14302
|
Authentication Bypass by Capture-replay A flaw was found in Keycloak where an external identity provider, after successful authentication, redirects to … |
Vulnerable Vulnerable |