Search for packages
| purl | pkg:maven/org.keycloak/keycloak-services@3.2.0.CR1 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-895x-rfqp-jh5c
Aliases: CVE-2025-12110 |
Keycloak does not invalidate offline sessions when the offline_access scope is removed A flaw was found in Keycloak. An offline … |
Vulnerable |
|
GHSA-64w3-5q9m-68xf
Aliases: CVE-2025-11429 |
Keycloak does not invalidate sessions when "Remember Me" is disabled A flaw was found in Keycloak. Keycloak does not immediately … | There are no reported fixed by versions. |
|
GHSA-rg35-5v25-mqvp
Aliases: CVE-2025-12390 |
Keycloak vulnerable to session takeovers due to reuse of session identifiers A flaw was found in Keycloak. In Keycloak where … |
Vulnerable |
|
GHSA-fx44-2wx5-5fvp
|
Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass # Duplicate Advisory This advisory has been withdrawn because it is … |
Vulnerable |
|
GHSA-r934-w73g-v4p8
|
Duplicate Advisory: Keycloak hostname verification # Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hw58-3793-42gg. … |
Vulnerable |
|
GHSA-5jfq-x6xp-7rw2
Aliases: CVE-2025-3910 |
Keycloak vulnerable to two factor authentication bypass # Description A flaw was found in Keycloak. The org.keycloak.authorization package may be … |
Vulnerable |
|
GHSA-hw58-3793-42gg
Aliases: CVE-2025-3501 |
Keycloak hostname verification A flaw was found in Keycloak. By setting a verification policy to 'ANY', the trust store certificate … |
Vulnerable |
|
GHSA-6q37-7866-h27j
Aliases: CVE-2025-14082 |
Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions A flaw was found in Keycloak Admin REST … |
Vulnerable |
|
GHSA-rq4w-cjrr-h8w8
Aliases: CVE-2025-1391 |
Duplicate Advisory: Keycloak allows Incorrect Assignment of an Organization to a User # Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-gj52-35xm-gxjh
|
Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow ### Duplicate Advisory This advisory has been … |
Vulnerable |
|
GHSA-83j7-mhw9-388w
|
Duplicate Advisory: Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled) ### Duplicate Advisory This advisory has been withdrawn because … | There are no reported fixed by versions. |
|
GHSA-xhpr-465j-7p9q
Aliases: CVE-2025-7365 |
Keycloak phishing attack via email verification step in first login flow There is a flaw with the first login flow … | There are no reported fixed by versions. |
|
GHSA-qj5r-2r5p-phc7
|
Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability ### Duplicate Advisory This advisory has been withdrawn because it is a duplicate of … | There are no reported fixed by versions. |
|
GHSA-2935-2wfm-hhpv
Aliases: CVE-2025-2559 |
Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache A flaw was found in Keycloak. When the configuration uses … | There are no reported fixed by versions. |
|
GHSA-gvgg-2r3r-53x7
Aliases: CVE-2025-1391 |
Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims This vulnerability is caused by the improper mapping of users … | There are no reported fixed by versions. |
|
GHSA-m4j5-5x4r-2xp9
Aliases: CVE-2025-8419 |
Keycloak SMTP Inject Vulnerability Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. … | There are no reported fixed by versions. |
|
GHSA-mwm4-5qwr-g9pf
Aliases: GMS-2022-1099 |
Keycloak is vulnerable to IDN homograph attack A flaw was found in keycloak, where IDN homograph attacks are possible. This … |
Vulnerable |
|
GHSA-75p6-52g3-rqc8
Aliases: CVE-2022-1245 GMS-2022-1039 |
Keycloak vulnerable to privilege escalation on Token Exchange feature A privilege escalation flaw was found in the token exchange feature … |
Vulnerable |
|
GHSA-pf38-cw3p-22q9
Aliases: CVE-2021-3424 |
Keycloak is vulnerable to IDN homograph attack A flaw was found in keycloak as shipped in Red Hat Single Sign-On … |
Vulnerable |
|
GHSA-484q-784p-8m5h
Aliases: CVE-2020-10776 |
Cross-site Scripting in keycloak A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe … |
Vulnerable |
|
GHSA-83x4-9cwr-5487
Aliases: CVE-2021-4133 |
Improper Authorization in Keycloak A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any … |
Vulnerable |
|
GHSA-wq8x-cg39-8mrr
Aliases: CVE-2024-10270 |
org.keycloak:keycloak-services has Inefficient Regular Expression Complexity A vulnerability was found in the Keycloak-services package. If untrusted data is passed to … | There are no reported fixed by versions. |
|
GHSA-j3x3-r585-4qhg
|
Duplicate Advisory: org.keycloak:keycloak-services has Inefficient Regular Expression Complexity ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-m6q9-p373-g5q8
Aliases: CVE-2024-1249 |
Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin … | There are no reported fixed by versions. |
|
GHSA-7fpj-9hr8-28vh
Aliases: CVE-2023-0657 |
Keycloak vulnerable to impersonation via logout token exchange Keycloak was found to not properly enforce token types when validating signatures … | There are no reported fixed by versions. |
|
GHSA-4f53-xh3v-g8x4
Aliases: CVE-2023-3597 |
Keycloak secondary factor bypass in step-up authentication Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could … | There are no reported fixed by versions. |
|
GHSA-72vp-xfrc-42xm
Aliases: CVE-2024-1132 |
Keycloak path traversal vulnerability in redirection validation A flaw was found in Keycloak, where it does not properly validate URLs … | There are no reported fixed by versions. |
|
GHSA-mrv8-pqfj-7gp5
Aliases: CVE-2024-2419 |
Keycloak path traversal vulnerability in the redirect validation An issue was found in the redirect_uri validation logic that allows for … | There are no reported fixed by versions. |
|
GHSA-8rmm-gm28-pj8q
Aliases: CVE-2023-6717 |
Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow Keycloak allows arbitrary URLs as SAML Assertion … | There are no reported fixed by versions. |
|
GHSA-c9h6-v78w-52wj
Aliases: CVE-2023-6787 |
Keycloak vulnerable to session hijacking via re-authentication A flaw was found in Keycloak. An active keycloak session can be hijacked … | There are no reported fixed by versions. |
|
GHSA-46c8-635v-68r2
Aliases: CVE-2023-6544 |
Keycloak Authorization Bypass vulnerability Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, … | There are no reported fixed by versions. |
|
GHSA-2cww-fgmg-4jqc
Aliases: CVE-2024-3656 |
Keycloak's admin API allows low privilege users to use administrative functions Users with low privileges (just plain users in the … |
Vulnerable |
|
GHSA-4vc8-pg5c-vg4x
Aliases: CVE-2021-3754 |
Keycloak's improper input validation allows using email as username Keycloak allows the use of email as a username and doesn't … |
Vulnerable |
|
GHSA-69fp-7c8p-crjr
Aliases: CVE-2024-4540 |
Keycloak exposes sensitive information in Pushed Authorization Requests (PAR) A flaw was found in Keycloak in the OAuth 2.0 Pushed … |
Vulnerable |
|
GHSA-cq42-vhv7-xr7p
Aliases: CVE-2024-1722 |
Keycloak Denial of Service via account lockout In any realm set with "User (Self) registration" a user that is registered … |
Vulnerable |
|
GHSA-4vrx-8phj-x3mg
|
Duplicate Advisory: Keycloak exposes sensitive information in Pushed Authorization Requests (PAR) ## Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-vvf8-2h68-9475
|
Duplicate Advisory: Keycloak Open Redirect vulnerability # Duplicate Advisory This advisory has been withdrawn because it is a duplicate of … |
Vulnerable |
|
GHSA-j76j-rqwj-jmvv
|
Duplicate Advisory: Keycloak Session Fixation vulnerability # Duplicate Advisory This advisory has been withdrawn because it is a duplicate of … | There are no reported fixed by versions. |
|
GHSA-8wm9-24qg-m5qj
|
Duplicate Advisory: Keycloak has a brute force login protection bypass ## Duplicate Advisory This advisory has been withdrawn because it … |
Vulnerable |
|
GHSA-gc7q-jgjv-vjr2
Aliases: CVE-2024-4629 |
Keycloak Services has a potential bypass of brute force protection If an attacker launches many login attempts in parallel then … | There are no reported fixed by versions. |
|
GHSA-8hc5-rmgf-qx6p
Aliases: CVE-2022-2232 |
Keycloak vulnerable to LDAP Injection on UsernameForm Login A flaw was found in the Keycloak package. This flaw allows an … |
Vulnerable |
|
GHSA-mpwq-j3xf-7m5w
Aliases: CVE-2023-6291 |
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted An issue was found in … |
Vulnerable |
|
GHSA-cvg2-7c3j-g36j
Aliases: CVE-2023-6134 |
Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri Keycloak prevents certain schemes in redirects, but permits them if … |
Vulnerable |
|
GHSA-5968-qw33-h47j
|
Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri ## Duplicate Advisory This advisory has been withdrawn … |
Vulnerable |
|
GHSA-f5h4-wmp5-xhg6
Aliases: CVE-2023-2585 |
Client Spoofing within the Keycloak Device Authorisation Grant Under certain pre-conditions the vulnerability allows an attacker to spoof parts of … |
Vulnerable |
|
GHSA-3qh5-qqj2-c78f
Aliases: CVE-2023-2422 |
Keycloak vulnerable to Improper Client Certificate Validation for OAuth/OpenID clients When a Keycloak server is configured to support mTLS authentication … |
Vulnerable |
|
GHSA-3p62-6fjh-3p5h
Aliases: CVE-2022-4361 |
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC AssertionConsumerServiceURL is a Java implementation for SAML Service … |
Vulnerable |
|
GHSA-9g98-5mj6-f9mv
Aliases: CVE-2023-0264 |
Keycloak vulnerable to user impersonation via stolen UUID code Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. … |
Vulnerable |
|
GHSA-m4fv-gm5m-4725
Aliases: CVE-2022-1274 GMS-2023-528 |
HTML Injection in Keycloak Admin REST API The `execute-actions-email` endpoint of the Keycloak Admin REST API allows a malicious actor … |
Vulnerable |
|
GHSA-w354-2f3c-qvg9
Aliases: CVE-2022-1438 |
Keycloak vulnerable to Cross-site Scripting A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during … | There are no reported fixed by versions. |
|
GHSA-f2hx-5fx3-hmcv
Aliases: CVE-2026-4636 |
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants A flaw was found in Keycloak. An authenticated user with … |
Vulnerable |
|
GHSA-cjm2-j6cm-6p6m
Aliases: CVE-2026-3872 |
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint A flaw was found in Keycloak. This … |
Vulnerable |
|
GHSA-rx66-hj7g-28h7
Aliases: CVE-2026-4325 |
Keycloak: Replay of action tokens via improper handling of single-use entries A flaw was found in Keycloak. The SingleUseObjectProvider, a … |
Vulnerable |
|
GHSA-h4wv-g838-66g3
Aliases: CVE-2026-4634 |
Keycloak: Application-Level DoS via Scope Processing A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by … |
Vulnerable |
|
GHSA-hj93-h7pg-fh6v
Aliases: CVE-2026-4282 |
Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw A flaw was found in Keycloak. The SingleUseObjectProvider, … |
Vulnerable |
|
GHSA-37gf-gmxv-74wv
Aliases: CVE-2026-1486 |
Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens A flaw was found in Keycloak. … | There are no reported fixed by versions. |
|
GHSA-fm6w-rrp3-2x4w
Aliases: CVE-2025-14778 |
Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService A flaw was found in Keycloak. A significant Broken Access … | There are no reported fixed by versions. |
|
GHSA-fjf4-6f34-w64q
Aliases: CVE-2026-2733 |
Keycloak: Missing Check on Disabled Client for Docker Registry Protocol A flaw was identified in the Docker v2 authentication endpoint … | There are no reported fixed by versions. |
|
GHSA-7g5x-9c4v-4w5r
Aliases: CVE-2025-12150 |
Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass A flaw was found in Keycloak’s WebAuthn registration component. This … |
Vulnerable |
|
GHSA-g78x-7vwx-9f58
Aliases: CVE-2025-13881 |
Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes A flaw was found in Keycloak … | There are no reported fixed by versions. |
|
GHSA-hcvw-475w-8g7p
Aliases: CVE-2026-1529 |
Keycloak affected by improper invitation token validation A flaw was found in Keycloak. An attacker can exploit this vulnerability by … | There are no reported fixed by versions. |
|
GHSA-w4p5-rfh6-cwrv
Aliases: CVE-2026-37982 |
Keycloak: Unauthorized account takeover via WebAuthn token replay A flaw was found in Keycloak. This authentication vulnerability allows a remote … |
Vulnerable |
|
GHSA-4x37-hw65-52w8
Aliases: CVE-2026-37979 |
Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass A flaw was found in Keycloak. This access control vulnerability … |
Vulnerable |
|
GHSA-hq3p-w4xv-x7vp
Aliases: CVE-2026-7571 |
Keycloak: Access token disclosure and implicit flow bypass via forged client data A flaw was found in Keycloak. A low-privilege … |
Vulnerable |
|
GHSA-hf67-5vvq-fm3r
Aliases: CVE-2026-7507 |
Keycloak: Session fixation in OIDC login flow that can lead to account takeover A session fixation vulnerability was found in … |
Vulnerable |
|
GHSA-rrv7-3mqf-hxfr
Aliases: CVE-2026-37978 |
Keycloak: Information Disclosure via evaluate-scopes Admin API A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role … |
Vulnerable |
|
GHSA-rp95-xpg9-c2cq
Aliases: CVE-2026-7504 |
Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak A flaw was found in Keycloak's URL validation logic … |
Vulnerable |
|
GHSA-7xf9-4jfc-wgm4
Aliases: CVE-2026-3121 |
Keycloak: manage-clients permission escalates to full realm admin access A flaw was found in Keycloak. An administrator with `manage-clients` permission … |
Vulnerable |
|
GHSA-xh32-c9wx-phrp
Aliases: CVE-2026-3911 |
Keycloak: Information disclosure of disabled user attributes via administrative endpoint A flaw was found in Keycloak. An authenticated user with … | There are no reported fixed by versions. |
|
GHSA-q35r-vvhv-vx5h
Aliases: CVE-2026-3190 |
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure A flaw was found in Keycloak. … |
Vulnerable |
|
GHSA-m297-3jv9-m927
Aliases: CVE-2026-3009 |
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator A security flaw … |
Vulnerable |
|
GHSA-x4p7-7chp-64hq
Aliases: CVE-2026-2603 |
Keycloak: Unauthorized authentication via disabled SAML Identity Provider A flaw was found in Keycloak. A remote attacker could bypass security … |
Vulnerable |
|
GHSA-8g9r-9wjw-37j4
Aliases: CVE-2026-3429 |
Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API A flaw was identified … | There are no reported fixed by versions. |
|
GHSA-m2w5-7xhv-w6fh
Aliases: CVE-2026-1035 |
Keycloak does not validate and update refresh token usage atomically A flaw was found in the Keycloak server during refresh … | There are no reported fixed by versions. |
|
GHSA-wv3h-x6c4-r867
Aliases: CVE-2025-14559 |
Keycloak services allows the issuance of access and refresh tokens for disabled users A flaw was found in the keycloak-services … | There are no reported fixed by versions. |
|
GHSA-63v5-26vq-m4vm
Aliases: CVE-2026-1190 |
Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods A flaw was found in Keycloak's SAML brokering … | There are no reported fixed by versions. |
|
GHSA-594w-2fwp-jwrc
Aliases: CVE-2025-14083 |
Keycloak Admin REST API exposes backend schema and rules A flaw was found in the Keycloak Admin REST API. This … | There are no reported fixed by versions. |
|
CVE-2020-1725
|
Exposure of Resource to Wrong Sphere A flaw was found in keycloak In some scenarios a user still has access … |
Vulnerable |
|
CVE-2020-1758
|
Improper Certificate Validation A flaw was found in Keycloak where it does not perform the TLS hostname verification while sending … |
Vulnerable |
|
CVE-2021-20323
|
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A POST based reflected Cross Site Scripting vulnerability on has … | There are no reported fixed by versions. |
|
CVE-2021-20202
|
Insecure Temporary File A flaw was found in keycloak. Directories can be created prior to the Java process creating them … |
Vulnerable |
|
CVE-2020-1724
|
Insufficient Session Expiration A flaw was found in Keycloak. This flaw allows a malicious user that is currently logged-in, to … |
Vulnerable |
|
CVE-2020-14366
|
Path Traversal A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible … | There are no reported fixed by versions. |
|
CVE-2020-1727
|
Improper Input Validation A vulnerability was found in Keycloak where every Authorization URL that points to an IDP server lacks … |
Vulnerable |
|
CVE-2020-27838
|
Improper Authentication A flaw was found in keycloak The client registration endpoint allows fetching information about PUBLIC clients (like client … | There are no reported fixed by versions. |
|
CVE-2020-1744
|
Information Exposure When configuring a Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login … |
Vulnerable |
|
CVE-2024-8883
Aliases: GHSA-w8gr-xwp4-r9f7 |
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect A misconfiguration flaw was found in Keycloak. This issue can … |
Vulnerable |
|
CVE-2022-3916
|
Insufficient Session Expiration A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared … |
Vulnerable |
|
GHSA-hm32-hfmw-rhvg
Aliases: CVE-2026-7500 |
Keycloak has a Forced Browsing issue When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. … | There are no reported fixed by versions. |
|
GHSA-83c4-ffjp-mxp9
Aliases: CVE-2026-8922 |
Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured A flaw was found … | There are no reported fixed by versions. |
|
GHSA-g8vr-x4qh-25qg
Aliases: CVE-2026-8830 |
Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation A flaw was found in Keycloak. An authenticated user … |
Vulnerable Vulnerable |
|
GHSA-m6qj-3mpp-57v8
Aliases: CVE-2026-9087 |
Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromise A flaw was found in Keycloak. … |
Vulnerable Vulnerable |
|
GHSA-xvv8-8wh9-9fh2
Aliases: CVE-2018-10894 |
Keycloak Authentication Error It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could … |
Vulnerable Vulnerable |
|
GHSA-c739-f6xw-6pv2
Aliases: CVE-2026-4630 |
Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers Keycloak's Authorization Services feature … |
Vulnerable |
|
GHSA-933f-rg6j-f46p
Aliases: CVE-2026-37981 |
Keycloak Account Resources user lookup contains broken access control Keycloak's Account Resources user lookup endpoint allows a remote authenticated user, … | There are no reported fixed by versions. |
|
GHSA-v5g5-wwmp-jppw
Aliases: CVE-2026-9802 |
Keycloak has Insufficient Session Expiration A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is … | There are no reported fixed by versions. |
|
GHSA-8hcx-p7m8-gc28
|
Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement ### Duplicate Advisory This advisory has been withdrawn because … |
Vulnerable |
|
GHSA-33j3-g875-37rp
Aliases: CVE-2026-9792 |
Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege A flaw was found in Keycloak's Client Policies, specifically within … | There are no reported fixed by versions. |
|
GHSA-fqjh-8322-vgrv
Aliases: CVE-2026-9794 |
Keycloak Generates an Error Message Containing Sensitive Information A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit … | There are no reported fixed by versions. |
|
GHSA-rr5q-3xwr-f323
Aliases: CVE-2026-9704 |
Keycloak Vulnerable to Improper Validation of Specified Quantity in Input A flaw was found in Keycloak. An authenticated user with … |
Vulnerable |
|
GHSA-cpf7-j4cf-vqx4
Aliases: CVE-2026-9803 |
Keycloak has an Out-of-bounds Read A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this … | There are no reported fixed by versions. |
|
GHSA-4q93-v92x-p89f
Aliases: CVE-2026-9791 |
Keycloak Vulnerable to Incorrect Authorization A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit … | There are no reported fixed by versions. |
|
GHSA-32h4-44jj-c5vx
Aliases: CVE-2026-9795 |
Keycloak has privilege escalation via improper scope mapping enforcement ### Description A flaw was found in Keycloak's Fine-Grained Admin Permissions … |
Vulnerable |
|
GHSA-5v8v-xvjv-57x7
Aliases: CVE-2026-37977 |
Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim A flaw was found in … | There are no reported fixed by versions. |
|
GHSA-22rm-wp4x-v5cx
Aliases: CVE-2026-4874 |
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation A flaw was found in Keycloak. An authenticated attacker can perform … | There are no reported fixed by versions. |
|
GHSA-6g26-7cx5-mrrg
Aliases: CVE-2026-9088 |
Keycloak: Information disclosure due to user profile permission bypass A flaw was found in org.keycloak.services. An administrator with delegated access … |
Vulnerable |
|
GHSA-j628-q885-8gr5
Aliases: CVE-2023-6484 |
Keycloak vulnerable to log Injection during WebAuthn authentication or registration A flaw was found in keycloak 22.0.5. Errors in browser … | There are no reported fixed by versions. |
|
GMS-2023-573
Aliases: CVE-2023-0264 GHSA-9g98-5mj6-f9mv |
Keycloak vulnerable to user impersonation via stolen UUID code Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. … |
Vulnerable Vulnerable |
|
CVE-2023-6134
Aliases: GHSA-cvg2-7c3j-g36j |
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) A flaw was found in Keycloak that prevents … |
Vulnerable Vulnerable |
|
CVE-2020-10770
|
Server-Side Request Forgery (SSRF) A flaw was found in Keycloak, where it is possible to force the server to call … |
Vulnerable Vulnerable |
|
CVE-2020-14389
|
Improper Privilege Management It was found that Keycloak would permit a user with only view-profile role to manage the resources … |
Vulnerable Vulnerable |
|
CVE-2021-3513
|
Generation of Error Message Containing Sensitive Information A flaw was found in keycloak where a brute force attack is possible … |
Vulnerable Vulnerable |
|
CVE-2020-14302
|
Authentication Bypass by Capture-replay A flaw was found in Keycloak where an external identity provider, after successful authentication, redirects to … |
Vulnerable Vulnerable |
|
CVE-2023-6291
Aliases: GHSA-mpwq-j3xf-7m5w |
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted An issue was found in … |
Vulnerable Vulnerable |
|
CVE-2021-3632
|
Improper Authentication A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key … |
Vulnerable Vulnerable |
|
CVE-2021-3856
|
Files or Directories Accessible to External Parties ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the … |
Vulnerable Vulnerable |
|
CVE-2024-7341
Aliases: GHSA-5rxp-2rhr-qwqv |
Keycloak has session fixation in Elytron SAML adapters A session fixation issue was discovered in the SAML adapters provided by … |
Vulnerable Vulnerable |
|
GHSA-wcvj-vpvw-9rr5
Aliases: CVE-2026-9689 |
Keycloak Services has Improper Validation of Consistency within Input A flaw was found in Keycloak, an open-source identity and access … | There are no reported fixed by versions. |
|
GHSA-p3v8-fm5p-v84h
Aliases: CVE-2026-9793 |
Keycloak has an Improper Verification of Cryptographic Signature issue A flaw was found in Keycloak. When a JSON Web Encryption … | There are no reported fixed by versions. |
|
GHSA-q6h7-xxp7-7429
Aliases: CVE-2026-9798 |
Keycloak has an Authentication Bypass by Primary Weakness A flaw was found in Keycloak, an open-source identity and access management … | There are no reported fixed by versions. |
|
GHSA-5rxp-2rhr-qwqv
Aliases: CVE-2024-7341 |
Keycloak has session fixation in Elytron SAML adapters A session fixation issue was discovered in the SAML adapters provided by … | There are no reported fixed by versions. |
|
GHSA-w8gr-xwp4-r9f7
Aliases: CVE-2024-8883 |
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect A misconfiguration flaw was found in Keycloak. This issue can … |
Vulnerable |
|
GHSA-wmxr-6j5f-838p
|
Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions ### Duplicate Advisory This advisory has been withdrawn … | There are no reported fixed by versions. |
|
GHSA-xv6h-r36f-3gp5
Aliases: CVE-2026-2575 |
Keycloak: Denial of Service due to excessive SAMLRequest decompression A flaw was found in Keycloak. An unauthenticated remote attacker can … |
Vulnerable Vulnerable |
|
GHSA-m32f-8vh9-2hh3
Aliases: CVE-2026-37980 |
Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page A flaw was found in Keycloak, … | There are no reported fixed by versions. |
|
GHSA-4pgc-gfrr-wcmg
Aliases: CVE-2026-4628 |
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false A flaw was found in … | There are no reported fixed by versions. |
|
GHSA-rhgq-f8x5-j2jc
Aliases: CVE-2026-4633 |
Keycloak's identity-first login flow exposes user information A flaw was found in Keycloak. A remote attacker can exploit differential error … | There are no reported fixed by versions. |
|
GHSA-794g-x443-36f7
Aliases: CVE-2026-2092 |
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions Keycloak's SAML broker endpoint does not properly validate encrypted assertions … | There are no reported fixed by versions. |
|
GHSA-v3f7-2p4r-mwfw
Aliases: CVE-2026-9086 |
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass ### Description A flaw was found in Keycloak. A … |
Vulnerable |
|
GHSA-w3p3-7cjg-vgfw
Aliases: CVE-2026-9799 |
Keycloak allows unauthorized access to resources via uma permission ticket bypass ### Description A flaw was found in org.keycloak.authorization. An … |
Vulnerable |
|
GHSA-r7rc-c989-86g6
Aliases: CVE-2026-9705 |
Keycloak: Attacker can re-enable and take over disabled clients via registration access token ### Description A flaw was found in … |
Vulnerable |
|
GHSA-9jrw-8xf7-xqhq
Aliases: CVE-2026-9083 |
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing ### Description A flaw was found in Keycloak. A realm … |
Vulnerable |
|
GHSA-f5p5-6xmx-p252
Aliases: CVE-2026-9800 |
Keycloak vulnerable to authorization bypass via incorrect uri comparison ### Description A flaw was found in Keycloak Policy Enforcer. This … |
Vulnerable |