Skip to contentRedhat Keycloak vulnerabilities
- keycloak, red hat build of keycloak, build of keycloak 26.0 +1 more +3 moreOrg.keycloak/keycloak-services: keycloak smtp inject vulnerabilityCVE-2025-8419Fix available5.3 Medium
- red hat build of keycloak 26, build of keycloak 26.2, jboss enterprise application platform 8 +3 more +5 moreOrg.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)CVE-2025-7784Fix available6.5 Medium
- redhat keycloak, red hat build of keycloak 26, build of keycloak 26.0 +1 more +3 moreKeycloak: phishing attack via email verification step in first login flowCVE-2025-7365Fix available7.1 High
- redhat keycloak, red hat build of keycloak +1 moreKeycloak-core: keycloak environment informationCVE-2025-54162.7 Low
- red hat build of keycloak, build of keycloak 26.0 +1 moreOrg.keycloak.authentication: two factor authentication bypassCVE-2025-3910Fix available5.4 Medium
- red hat build of keycloak, fuse 7, jboss data grid 7 +14 more +16 moreWildfly: wildfly vulnerable to cross-site scripting (xss)CVE-2024-10234Fix available6.1 Medium
- red hat build of keycloak, build of keycloak 22, build of keycloak 24 +13 more +15 moreKeycloak: vulnerable redirect uri validation results in open redirecCVE-2024-8883Fix available6.1 Medium
- redhat keycloak, red hat build of quarkus, fuse 7 +6 more +8 moreKeycloak: amount of attributes per object is not limited and it may lead to dosCVE-2023-6841Fix available7.5 High
- redhat keycloak, red hat build of keycloak, build of keycloak 22 +8 more +10 moreWildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adaptersCVE-2024-7341Fix available7.1 High
- red hat build of keycloak, build of keycloak 24 +1 moreKeycloak-core: one time passcode (otp) is valid longer than expiration timeseverityCVE-2024-7318Fix available4.8 Medium
- redhat keycloak, red hat build of keycloak, build of keycloak 24 +2 moreKeycloak-core: open redirect on account pageCVE-2024-7260Fix available6.1 Medium
- redhat keycloak, red hat build of keycloak, build of keycloak 22 +11 more +13 moreKeycloak: potential bypass of brute force protectionCVE-2024-4629Fix available6.5 Medium
- red hat hawtio 4.0.0 for red hat build of apache camel 4, build of apache camel 3.20.7 for spring boot, build of apache camel 4.4.2 for spring boot +26 more +28 moreUndertow: improper state management in proxy protocol parsing causes information leakageCVE-2024-7885Fix available7.5 High
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.10 +2 more +4 moreKeycloak: session hijacking via re-authenticationCVE-2023-6787Fix available6.5 Medium
- redhat keycloak, red hat migration toolkit for runtimes 1 on rhel 8, mta-6.2-rhel-9 +26 more +28 moreKeycloak: path transversal in redirection validationCVE-2024-1132Fix available8.1 High
- redhat keycloak, red hat build of keycloak, single sign-on 7 +2 moreKeycloak-core: dos via account lockoutCVE-2024-1722Fix available3.7 Low
- redhat keycloak, red hat migration toolkit for applications 6, migration toolkit for applications 7 +21 more +23 moreKeycloak: redirect_uri validation bypassCVE-2023-6291Fix available7.1 High
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.8 +7 more +9 moreKeycloak: open redirect via "form_post.jwt" jarm response modeCVE-2023-6927Fix available4.6 Medium
- 9bis kitty, apache sshd, sshj +68 more +70 morePrefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka TerrapinCVE-2023-48795Public exploitFix availableEPSS 93.5%5.9 Medium
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.7 +10 more +12 moreKeycloak: reflected xss via wildcard in oidc redirect_uriCVE-2023-6134Fix available4.6 Medium
- redhat keycloak, red hat build of keycloak, single sign-on 7.6 for rhel 7 +8 more +10 moreKeycloak: offline session token dosCVE-2023-6563Fix available7.7 High
- redhat keycloak, red hat single sign-on 7 +1 morePlaintext storage of user passwordCVE-2023-4918Fix available8.8 High
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +5 more +7 moreKeycloak: oauth client impersonationCVE-2023-2422Fix available5.5 Medium
- keycloak, redhat openshift container platform, openshift container platform for ibm linuxone +2 more +4 moreKeycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDCCVE-2022-4361Public exploitFix available10.0 Critical
- keycloak, redhat build of quarkus, jboss a-mq +2 more +4 moreKeycloak Untrusted Certificate Validation vulnerabilityCVE-2023-1664Fix available6.5 Medium
- keycloak, redhat openshift container platform, openshift container platform for ibm linuxone +2 more +4 moreKeycloak vulnerable to user impersonation via stolen UUID codeCVE-2023-0264Public exploitFix available5.0 Medium
- keycloak, redhat keycloak node.js adapter, single sign-on +2 morekeycloak-connect contains Open redirect vulnerability in the Node.js adapterCVE-2022-2237Fix available6.1 Medium
- keycloak, redhat openshift container platform, single sign-on +2 moreHTML Injection in Keycloak Admin REST APICVE-2022-1274Public exploitFix available5.4 Medium
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +3 more +5 moreKeycloak: reflected xss attackCVE-2022-4137Public exploitFix available8.1 High
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +3 more +5 moreKeycloak: xss on impersonation under specific circumstancesCVE-2022-14386.4 Medium
- keycloakKeycloak: Impersonation and lockout possible through incorrect handling of email trustCVE-2023-0105Fix available6.5 Medium
- redhat keycloakKeycloak has lack of validation of access token on client registrations endpointCVE-2023-0091Fix available3.8 Low
- keycloakKeycloak vulnerable to path traversal via double URL encodingCVE-2022-3782Public exploitFix available9.1 Critical
- redhat keycloak, red hat single sign-on 7, single sign-on 7.6 for rhel 7 +9 more +11 moreKeycloak: session takeover with oidc offline refreshtokensCVE-2022-3916Fix available6.8 Medium
- keycloak, redhat single sign-on +1 moreStored Cross-Site Scripting (XSS) in Keycloak via groups dropdownCVE-2022-0225Fix available5.4 Medium
- keycloak, redhat single sign-on +1 moreKeycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flowCVE-2021-3632Fix available7.5 High
- keycloak, redhat single sign-on +1 moreKeycloak's improper input validation allows using email as usernameCVE-2021-3754Public exploitFix available5.3 Medium
- keycloakKeycloak has Files or Directories Accessible to External PartiesCVE-2021-3856Fix available4.3 Medium
- keycloakKeycloak vulnerable to Improper Certificate ValidationCVE-2020-35509Fix available5.4 Medium
- keycloakIncorrect implementation of lockout feature in KeycloakCVE-2021-3513Fix available7.5 High
- keycloak, redhat single sign-on +1 moreKeycloak SAML javascript protocol mapper: Uploading of scripts through admin consoleCVE-2022-2668Fix available7.2 High
- keycloak, redhat openshift container platform, single sign-on +2 moreECP SAML binding bypasses authentication flowsCVE-2021-3827Fix available6.8 Medium
- keycloakKeycloak vulnerable to privilege escalation on Token Exchange featureCVE-2022-1245Fix available9.8 Critical
- redhat keycloak, single sign-on +1 moreImproper authorization in KeycloakCVE-2022-1466Fix available6.5 Medium
- keycloak, redhat single sign-on +1 moreKeycloak insufficient session expirationCVE-2021-3461Fix available7.1 High
- redhat keycloak, red hat keycloak-services +1 moreCross-site Scripting in KeycloakCVE-2021-20323Public exploitFix availableEPSS 37.2%6.1 Medium
- keycloakImproper Authorization in KeycloakCVE-2021-4133Fix available8.8 High
- redhat keycloak, single sign-on +1 moreAllocation of resources without limits or throttling in keycloak-model-infinispanCVE-2021-3637Fix available7.5 High
- keycloakkeycloak Self Stored Cross-site Scripting vulnerabilityCVE-2021-20195Fix available9.6 Critical
- keycloak, redhat single sign-on +1 moreAuthentication Bypass in keycloakCVE-2020-27826Fix available4.2 Medium
- Show moreLoading…