Skip to contentRedhat Keycloak vulnerabilities
- keycloakTemporary Directory Hijacking Vulnerability in KeycloakCVE-2021-20202Fix available7.3 High
- keycloakCode injection in keycloakCVE-2021-20222Fix available7.5 High
- keycloak, redhat single sign-on +1 moreKeycloak Missing authentication for critical functionCVE-2021-202626.8 Medium
- keycloak, redhat single sign-on +1 moreKeycloak discloses information without authenticationCVE-2020-27838Public exploitFix availableEPSS 17.9%6.5 Medium
- keycloak, redhat openshift application runtimes, single sign-on +1 more +3 moreOIDC Logout redirect in keycloakCVE-2020-10734Fix available3.3 Low
- keycloak, redhat jboss fuse, openshift application runtimes +1 more +3 moreGeneration of Error Message Containing Sensitive Information in KeycloakCVE-2020-17172.7 Low
- keycloakIncorrect Authorization in keycloakCVE-2020-1725Fix available5.4 Medium
- keycloakA flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful...CVE-2020-143024.9 Medium
- keycloakKeycloak vulnerable to Server-Side Request ForgeryCVE-2020-10770Public exploitFix availableEPSS 69.7%5.3 Medium
- keycloakCross-site Scripting in keycloakCVE-2020-10776Fix available4.8 Medium
- keycloakImproper privilege management in KeycloakCVE-2020-14389Fix available8.1 High
- keycloakPath TraversalCVE-2020-14366Fix available6.8 Medium
- keycloakIncorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in KeycloakCVE-2020-1694Fix available4.9 Medium
- keycloak, redhat single sign-on +1 moreCross-site Scripting in KeycloakCVE-2020-10748Fix available6.1 Medium
- keycloak, redhat openshift application runtimes, single sign-on +2 moreAllocation of Resources Without Limits or Throttling in KeycloakCVE-2020-10758Fix available7.5 High
- [unknown] keycloakA vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to...CVE-2020-17276.4 Medium
- keycloak, redhat openstack +1 moreImproper Certificate Validation and Improper Validation of Certificate with Host Mismatch in KeycloakCVE-2020-1758Fix available5.3 Medium
- keycloak, quarkus, redhat decision manager +4 more +6 moreImproper Input Validation in KeycloakCVE-2020-1714Fix available7.5 High
- keycloak, redhat jboss fuse, openshift application runtimes +2 moreImproper Authentication for KeycloakCVE-2020-1718Fix available7.1 High
- keycloak, redhat openshift application runtimes, single sign-on +2 moreKeycloak Insufficient Session ExpiryCVE-2020-1724Fix available4.3 Medium
- keycloakKeycloak leaks sensitive information in logged exceptionsCVE-2020-1698Fix available5.0 Medium
- [unknown] keycloakPrivilege Defined With Unsafe Actions in KeycloakCVE-2019-10170Fix available6.6 Medium
- [unknown] keycloakKeycloak code execution via UMA policy abuseCVE-2019-10169Fix available6.6 Medium
- keycloakKeycloak users may be able to remove MFA from other users' devicesCVE-2020-10686Fix available4.1 Medium
- [unknown] keycloak, quarkus +1 moreImproper Restriction of Rendered UI Layers or Frames in KeycloakCVE-2020-17284.8 Medium
- keycloakExposure of Sensitive Information in keycloakCVE-2020-1744Fix available5.6 Medium
- keycloak, redhat keycloak operator +1 morePredictable password in KeycloakCVE-2020-1731Fix available9.1 Critical
- keycloak, redhat single sign-on +1 moreXSS in KeycloakCVE-2020-1697Fix available6.1 Medium
- keycloak, redhat jboss enterprise application platform, jboss fuse +1 more +3 moreExposure of Sensitive Information to an Unauthorized Actor in KeycloakCVE-2019-14820Fix available4.3 Medium
- keycloak, redhat single sign-on +1 morekeycloak vulnerable to unauthorized login via mail server setupCVE-2019-14837Fix available9.1 Critical
- jboss keycloak keycloakJBoss KeyCloak Open RedirectCVE-2014-3652Fix available6.1 Medium
- jboss keycloak keycloak, redhat jboss keycloak +1 moreJBoss KeyCloak Cross-site Scripting VulnerabilityCVE-2014-3656Public exploitFix available6.1 Medium
- keycloakKeycloak Authentication ErrorCVE-2019-149109.3 Critical
- keycloakKeycloak Authentication ErrorCVE-2019-149099.3 Critical
- jboss keycloak, redhat jboss enterprise web server +1 moreJBoss KeyCloak is vulnerable to soft token deletion via CSRFCVE-2014-3655Fix available4.3 Medium
- keycloak rest api, redhat keycloak +1 moreKeycloak Unauthenticated AccessCVE-2019-14832Fix available5.0 Medium
- keycloak, redhat single sign-on +1 moreImproper Verification of Cryptographic Signature in keycloakCVE-2019-10201Fix available8.1 High
- keycloakImproper Input Validation and Cross-Site Request Forgery in KeycloakCVE-2019-10199Fix available4.6 Medium
- keycloak, redhat single sign-on +1 moreImproper Certificate Validation and Insufficient Verification of Data Authenticity in KeycloakCVE-2019-38756.5 Medium
- keycloak, redhat single sign-on +1 moreForced Logout in keycloak-connectCVE-2019-10157Fix available4.7 Medium
- keycloakExposure of Sensitive Information to an Unauthorized Actor in KeycloakCVE-2019-3868Fix available3.8 Low
- [unknown] keycloakImproper Authentication in KeycloakCVE-2018-14637Fix available6.1 Medium
- keycloakKeycloak Open RedirectCVE-2018-146586.1 Medium
- keycloak, redhat single sign-on +1 moreKeycloak Improper Bruteforce DetectionCVE-2018-14657Fix available5.4 Medium
- keycloak, redhat single sign-on +1 moreKeycloak vulnerable to cross-site scripting via the state parameterCVE-2018-146554.6 Medium
- keycloak, redhat single sign-on +1 moreKeycloak Authentication ErrorCVE-2018-10894Fix available5.4 Medium
- keycloakImproper Authentication in org.keycloak:keycloak-coreCVE-2016-8609Fix available3.7 Low
- keycloakKeycloak vulnerable to infinite loop based Denial of ServiceCVE-2017-2646Fix available7.5 High
- keycloak, redhat jboss enterprise application platform +1 morekeycloak-core discloses system propertiesCVE-2017-2582Fix available6.5 Medium
- [unknown] keycloak, redhat single sign-on +1 moreModerate severity vulnerability that affects org.keycloak:keycloak-coreCVE-2018-10912Fix available4.4 Medium
- Show moreLoading…