CVE-2026-1609 | High | 8.1 | 2026-07-16 | A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to va… |
CVE-2025-12150 | Low | 3.1 | 2026-02-27 | A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register… |
CVE-2025-13467 | Medium | 5.5 | 2025-11-25 | A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of un… |
CVE-2025-11538 | Medium | 6.8 | 2025-11-13 | A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol… |
CVE-2025-12390 | Medium | 6.0 | 2025-10-28 | A flaw was found in Keycloak. In Keycloak where a user can accidentally get access to another user's session if both use the same device and browser. This happ… |
CVE-2025-10939 | Low | 3.7 | 2025-10-28 | A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occur… |
CVE-2025-12110 | Medium | 5.4 | 2025-10-23 | A flaw was found in Keycloak. An offline session continues to be valid when the offline_access scope is removed from the client. The refresh token is accepted… |
CVE-2025-11429 | Medium | 5.4 | 2025-10-23 | A flaw was found in Keycloak. Keycloak does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions create… |
CVE-2025-10044 | Medium | 4.3 | 2025-09-05 | A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the error_description query parameter. This text is directly… |
CVE-2025-9162 | Medium | 4.9 | 2025-08-21 | A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documen… |
CVE-2025-8419 | Medium | 5.3 | 2025-08-06 | A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwan… |
CVE-2022-4361 | Critical | 10.0 | 2023-07-07 | Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerabili… |
CVE-2020-10686 | Medium | 4.1 | 2020-05-04 | A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could… |
CVE-2019-14820 | Medium | 4.3 | 2020-01-08 | It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a speci… |
CVE-2019-14832 | High | 7.5 | 2019-10-15 | A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated att… |
CVE-2017-12161 | High | 8.8 | 2018-02-21 | It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker cou… |
CVE-2014-3651 | High | 7.5 | 2017-12-29 | JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/q… |
CVE-2017-12159 | High | 7.5 | 2017-10-26 | It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenti… |
CVE-2017-12158 | Medium | 5.4 | 2017-10-26 | It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw… |
CVE-2014-3709 | High | 8.8 | 2017-10-18 | The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request f… |
CVE-2017-7474 | Critical | 9.8 | 2017-05-12 | It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and… |