Keycloak

21 CVEs across 3 Keycloak products. Browse Keycloak vulnerabilities, severities, and proof-of-concept exploits.

Keycloak products with known CVEs

ProductCVEs
Keycloak19
Keycloak-Nodejs-Auth-Utils1
Keycloak Rest API1
Keycloak CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-1609High8.12026-07-16A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to va…
CVE-2025-12150Low3.12026-02-27A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register…
CVE-2025-13467Medium5.52025-11-25A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of un…
CVE-2025-11538Medium6.82025-11-13A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol…
CVE-2025-12390Medium6.02025-10-28A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happ…
CVE-2025-10939Low3.72025-10-28A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occur…
CVE-2025-12110Medium5.42025-10-23A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted…
CVE-2025-11429Medium5.42025-10-23A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions create…
CVE-2025-10044Medium4.32025-09-05A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly…
CVE-2025-9162Medium4.92025-08-21A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documen…
CVE-2025-8419Medium5.32025-08-06A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwan…
CVE-2022-4361Critical10.02023-07-07Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerabili…
CVE-2020-10686Medium4.12020-05-04A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could…
CVE-2019-14820Medium4.32020-01-08It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a speci…
CVE-2019-14832High7.52019-10-15A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated att…
CVE-2017-12161High8.82018-02-21It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker cou…
CVE-2014-3651High7.52017-12-29JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/q…
CVE-2017-12159High7.52017-10-26It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenti…
CVE-2017-12158Medium5.42017-10-26It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw…
CVE-2014-3709High8.82017-10-18The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request f…
CVE-2017-7474Critical9.82017-05-12It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and…