Keycloak vulnerabilities

Products

• Keycloak 90

Newest

• keycloak, red hat build of keycloak +1 more Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch CVE-2026-90997 7.4 HighSeptember 17, 2026
• keycloak, red hat jboss enterprise application platform 8, jboss enterprise application platform expansion pack +1 more +3 more Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users CVE-2026-1609 Fix available 8.1 HighJuly 16, 2026
• keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +3 more +5 more Org.keycloak/keycloak-services: webauthn attestation statement verification bypass CVE-2025-12150 Fix available 3.1 LowFebruary 27, 2026
• keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 more Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation CVE-2025-13467 Fix available 5.5 MediumNovember 25, 2025
• keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.4 +2 more Keycloak-server: debug default bind address CVE-2025-11538 Fix available 6.8 MediumNovember 13, 2025
• keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 more Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id CVE-2025-12390 Fix available 6.0 MediumOctober 28, 2025
• keycloak, red hat build of keycloak 26.4, build of keycloak 26.4.4 +2 more Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console CVE-2025-10939 Fix available 3.7 LowOctober 28, 2025
• keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more +4 more Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed CVE-2025-12110 Fix available 5.4 MediumOctober 23, 2025
• keycloak, red hat build of keycloak 26.2, build of keycloak 26.2.11 +2 more Keycloak-server: too long and not settings compliant session CVE-2025-11429 Fix available 5.4 MediumOctober 23, 2025
• keycloak, red hat build of keycloak 26.0, build of keycloak 26.0.17 +2 more +4 more Keycloak: keycloak error_description injection on error pages CVE-2025-10044 Fix available 4.3 MediumSeptember 5, 2025
• keycloak, red hat build of keycloak 26.0, build of keycloak 26.2 +1 more +3 more Org.keycloak/keycloak-model-storage-service: variable injection into environment variables CVE-2025-9162 Fix available 4.9 MediumAugust 21, 2025
• keycloak, red hat build of keycloak, build of keycloak 26.0 +1 more +3 more Org.keycloak/keycloak-services: keycloak smtp inject vulnerability CVE-2025-8419 Fix available 5.3 MediumAugust 6, 2025
• keycloak, redhat openshift container platform, openshift container platform for ibm linuxone +2 more +4 more Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC CVE-2022-4361 Public exploitFix available 10.0 CriticalJune 30, 2023
• keycloak, redhat build of quarkus, jboss a-mq +2 more +4 more Keycloak Untrusted Certificate Validation vulnerability CVE-2023-1664 Fix available 6.5 MediumMay 26, 2023
• keycloak, redhat openshift container platform, openshift container platform for ibm linuxone +2 more +4 more Keycloak vulnerable to user impersonation via stolen UUID code CVE-2023-0264 Public exploitFix available 5.0 MediumMarch 2, 2023
• keycloak, redhat keycloak node.js adapter, single sign-on +2 more keycloak-connect contains Open redirect vulnerability in the Node.js adapter CVE-2022-2237 Fix available 6.1 MediumMarch 2, 2023
• keycloak, redhat openshift container platform, single sign-on +2 more HTML Injection in Keycloak Admin REST API CVE-2022-1274 Public exploitFix available 5.4 MediumMarch 1, 2023
• keycloak Keycloak: Impersonation and lockout possible through incorrect handling of email trust CVE-2023-0105 Fix available 6.5 MediumJanuary 11, 2023
• keycloak Keycloak vulnerable to path traversal via double URL encoding CVE-2022-3782 Public exploitFix available 9.1 CriticalDecember 13, 2022
• keycloak, redhat single sign-on +1 more Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles CVE-2022-2256 Fix available 3.8 LowSeptember 1, 2022
• keycloak, redhat single sign-on +1 more Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown CVE-2022-0225 Fix available 5.4 MediumAugust 26, 2022
• keycloak, redhat single sign-on +1 more Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow CVE-2021-3632 Fix available 7.5 HighAugust 26, 2022
• keycloak, redhat single sign-on +1 more Keycloak's improper input validation allows using email as username CVE-2021-3754 Public exploitFix available 5.3 MediumAugust 26, 2022
• keycloak Keycloak has Files or Directories Accessible to External Parties CVE-2021-3856 Fix available 4.3 MediumAugust 26, 2022
• keycloak Keycloak vulnerable to Improper Certificate Validation CVE-2020-35509 Fix available 5.4 MediumAugust 23, 2022
• keycloak Incorrect implementation of lockout feature in Keycloak CVE-2021-3513 Fix available 7.5 HighAugust 22, 2022
• keycloak, redhat single sign-on +1 more Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console CVE-2022-2668 Fix available 7.2 HighAugust 5, 2022
• keycloak, redhat openshift container platform, single sign-on +2 more ECP SAML binding bypasses authentication flows CVE-2021-3827 Fix available 6.8 MediumApril 27, 2022
• keycloak Keycloak vulnerable to privilege escalation on Token Exchange feature CVE-2022-1245 Fix available 9.8 CriticalApril 26, 2022
• keycloak, redhat single sign-on +1 more Keycloak insufficient session expiration CVE-2021-3461 Fix available 7.1 HighApril 1, 2022
• keycloak Improper Authorization in Keycloak CVE-2021-4133 Fix available 8.8 HighJanuary 6, 2022
• keycloak, redhat single sign-on +1 more Keycloak is vulnerable to IDN homograph attack CVE-2021-3424 Fix available 5.3 MediumJune 1, 2021
• keycloak keycloak Self Stored Cross-site Scripting vulnerability CVE-2021-20195 Fix available 9.6 CriticalMay 28, 2021
• keycloak, redhat single sign-on +1 more Authentication Bypass in keycloak CVE-2020-27826 Fix available 4.2 MediumMay 28, 2021
• keycloak Temporary Directory Hijacking Vulnerability in Keycloak CVE-2021-20202 Fix available 7.3 HighMay 12, 2021
• keycloak Code injection in keycloak CVE-2021-20222 Fix available 7.5 HighMarch 23, 2021
• keycloak, redhat single sign-on +1 more Keycloak Missing authentication for critical function CVE-2021-20262 6.8 MediumMarch 9, 2021
• keycloak, redhat single sign-on +1 more Keycloak discloses information without authentication CVE-2020-27838 Public exploitFix available EPSS 17.9% 6.5 MediumMarch 8, 2021
• keycloak, redhat louketo proxy +1 more Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers CVE-2020-14359 7.3 HighFebruary 23, 2021
• keycloak, redhat openshift application runtimes, single sign-on +1 more +3 more OIDC Logout redirect in keycloak CVE-2020-10734 Fix available 3.3 LowFebruary 11, 2021
• keycloak, redhat jboss fuse, openshift application runtimes +1 more +3 more Generation of Error Message Containing Sensitive Information in Keycloak CVE-2020-1717 2.7 LowFebruary 11, 2021
• keycloak Incorrect Authorization in keycloak CVE-2020-1725 Fix available 5.4 MediumJanuary 28, 2021
• keycloak A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful... CVE-2020-14302 4.9 MediumDecember 15, 2020
• keycloak Keycloak vulnerable to Server-Side Request Forgery CVE-2020-10770 Public exploitFix available EPSS 69.7% 5.3 MediumDecember 15, 2020
• keycloak Cross-site Scripting in keycloak CVE-2020-10776 Fix available 4.8 MediumNovember 17, 2020
• keycloak Improper privilege management in Keycloak CVE-2020-14389 Fix available 8.1 HighNovember 17, 2020
• keycloak Path Traversal CVE-2020-14366 Fix available 6.8 MediumNovember 9, 2020
• keycloak Incorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak CVE-2020-1694 Fix available 4.9 MediumSeptember 16, 2020
• keycloak, redhat single sign-on +1 more Cross-site Scripting in Keycloak CVE-2020-10748 Fix available 6.1 MediumSeptember 16, 2020
• keycloak, redhat openshift application runtimes, single sign-on +2 more Allocation of Resources Without Limits or Throttling in Keycloak CVE-2020-10758 Fix available 7.5 HighSeptember 16, 2020
• Show olderLoading…