Keycloak
Monthly
Replay protection bypass in Keycloak deployed in stateless mode with a MySQL or MariaDB backend allows remote, unauthenticated attackers who have captured a still-valid single-use artifact - such as a JWT client assertion, a DPoP proof, or a TOTP code - to replay it against the token endpoint or login flow and obtain unauthorized access. The weakness is a mismatch in row-count semantics between the MySQL/MariaDB database driver and Keycloak's application logic, which silently defeats the one-time-use check; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4) reflects high confidentiality and integrity impact tempered by the hard configuration prerequisite and the requirement to intercept a valid artifact before it expires. At time of analysis no public exploit identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); the non-default stateless plus MySQL/MariaDB deployment combination, the need for a network position capable of capturing artifacts, and the narrow validity window keep practical exploitability constrained.
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. This is an access-gated issue rather than a pre-authentication takeover: the CVSS vector (PR:H) confirms the attacker must be an authenticated, privileged sub-administrator or holder of a compromised delegated-admin credential before exploitation is possible, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Missing authorization enforcement in the Keycloak policy enforcer lets an authenticated user bypass path-based security policies in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments, gaining access to administrative or private application endpoints that the configured policies intended to protect. The flaw lies in how the enforcer normalizes request URLs containing encoded semicolons or directory-traversal segments, causing it to select a less restrictive policy than the one the backend application ultimately resolves to. Exploitation requires a valid account (even low-privileged), network reachability and an application deployed behind the policy enforcer using path-based authorization; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited. Red Hat has published errata addressing the defect.
Authentication bypass in the Apache Airflow Keycloak auth manager provider (apache-airflow-providers-keycloak below 0.10.0) lets a remote attacker exchange credentials belonging to any confidential client in a shared Keycloak realm for a signed Airflow session token, even though those credentials have nothing to do with Airflow. The unauthenticated POST /auth/token client_credentials grant performed no allowlist check on client_id, so an unrelated application's service-account secret became a valid Airflow login; the resulting access is limited to whatever that service account is authorized for per subject, plus endpoints gated only on being authenticated. Exploitation requires a non-default topology - a Keycloak auth manager deployment whose realm is shared with at least one other confidential client - and the attacker must already hold valid credentials for one of those clients; no public exploit code has been identified at time of analysis, EPSS is low (0.19%, 9th percentile), and a vendor patch is available in provider version 0.10.0.
Privilege escalation in the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak) affecting Airflow 3.3 and later lets an authenticated user who already holds a valid Airflow session pair it with another subject's Keycloak access or refresh token - obtained out of band via cookie theft, proxy capture or a leaked token - so Airflow authorizes their requests with the foreign token's privileges while the audit log, cache keys and session identity continue to name the attacker's own account. The official CVSS of 9.1 overstates practical risk: exploitation requires both a valid Airflow login and a genuine (not forged) Keycloak token belonging to someone else, and the opt-in Keycloak auth manager is not Airflow's default authentication backend, so the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N rather than AV:N/AC:L/PR:N. There is no public exploit code and no confirmed active exploitation (EPSS 0.21%, 11th percentile); upgrading the provider to 0.10.0 or later restores the subject binding between session and Keycloak tokens.
Access-control bypass in Keycloak (fixed in 26.5.3) lets a disabled user account still obtain valid tokens through the JWT authorization grant preview feature. When that feature is enabled, Keycloak omits the account-enabled check during JWT authorization grant processing, so a low-privileged remote attacker who can present a valid assertion token from an external identity provider can mint a JWT for an account an administrator has explicitly disabled, regaining access to protected resources. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Keycloak's SAML identity provider broker fails to enforce client disabled status during IdP-initiated SSO flows, allowing attackers with valid credentials to establish authenticated sessions and access other enabled clients without re-authentication. An authenticated remote attacker can exploit this authentication bypass to gain unauthorized access to protected resources across the Keycloak ecosystem. No patch is currently available.
Stored cross-site scripting in the login theme rendering component of Keycloak (and its downstream Red Hat Build of Keycloak and Red Hat Single Sign-On 7 products) lets a realm administrator inject malicious JavaScript into display fields that is later executed in the browsers of users loading the affected realm's login page. Exploitation requires an authenticated realm administrator (CVSS PR:H) who can both reach the theme display fields and bypass the input-sanitizing security filter, so this is a privilege-abuse or post-compromise vector rather than an anonymous remote attack; impact is limited to the confidentiality and integrity of affected users' sessions (C:L/I:L) with no availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing; overall this is a genuine but modest-priority issue rather than a high-urgency crisis.
Keycloak's Dynamic Client Registration flow fails to filter security-sensitive client attributes, allowing an authenticated attacker with a valid Initial Access Token to register a client that bypasses audience checks during token introspection. This results in read-only disclosure of sensitive identity information, roles, and session details from access tokens belonging to other applications in the same realm. The flaw is rated CVSS 6.5 and requires the target realm to have Dynamic Client Registration enabled and the attacker to possess a registration token; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Keycloak's User Session Note protocol mapper fails to screen session note keys for sensitive internal credentials, allowing an authenticated delegated client administrator to copy a victim's upstream federated access/bearer token into tokens issued to the application they manage (CVSS 3.1 5.7, AV:N/AC:L/PR:L/UI:R, C:H/I:N/A:N). Exploitation requires the attacker to hold scoped client-administration rights sufficient to configure protocol mappers, a realm federated with external identity providers that persist upstream tokens as user session notes, and the victim to actually authenticate to the attacker-controlled client, so impact is decisive only in federated-token deployments and default configurations without federated token storage are not exposed. Red Hat has published an advisory and Bugzilla record for the issue, but no public exploit code and no confirmed active exploitation were identified in the available intelligence at time of analysis.
Information disclosure and denial of service in Keycloak's X.509 client certificate authenticator occur when CRL Distribution Point checking is enabled and an unauthenticated remote attacker submits a crafted client certificate. The server fails to properly validate file paths from the certificate, allowing limited local file reads and extreme memory consumption that can crash the system; exploitation requires the non-default combination of certificate-based client authentication and CRL checking, and no public exploit was identified at time of analysis.
Keycloak's Micrometer user-event metrics listener can be forced to create unbounded metric time series by unauthenticated remote requests to the identity broker login endpoint with arbitrary provider aliases, leading to memory exhaustion and performance degradation. This is a low-priority issue because exploitation requires the non-default configuration of including the 'idp' tag in the listener, and the impact is limited to a gradual availability degradation (A:L). No public exploit code has been identified at the time of analysis.
Privilege escalation in the Fine-Grained Admin Permissions v2 (FGAP v2) feature of Keycloak lets an authenticated delegated administrator with role-assignment rights grant a composite role whose transitive contents are never inspected, silently conferring full realm administrative control. Exploitation requires that FGAP v2 be enabled for delegated administration, a limited-admin credential holding role-mapping permissions (CVSS vector PR:H), and the presence of a composite role that transitively contains realm-admin privileges within that administrator's assignable scope; the high attack complexity (AC:H) reflects these preconditions rather than any exploitation difficulty, and the resulting impact is a complete confidentiality, integrity, and availability compromise of the realm (CVSS 6.6). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this should be treated as a genuine but conditional authorization-logic flaw rather than a remotely exploitable takeover.
Information disclosure in the Keycloak Admin REST API lets an authenticated delegated administrator holding only basic group/role search privileges enumerate every group assigned to a given role, including groups they are supposed to be unable to see. The flaw (CWE-862, missing authorization) affects the Admin REST API endpoints that return role-to-group mappings in Keycloak, Red Hat Build of Keycloak, and Red Hat Single Sign-On 7, and is rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) - a read-only confidentiality impact with no integrity or availability effect. It requires valid, privileged-but-scoped credentials and is only meaningful where an organization actually partitions group visibility across delegated admins; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Authenticated delegated administrators in Keycloak can reset other users' passwords and take over their accounts when Fine-Grained Admin Permissions (FGAP) are enabled, because the Admin REST API's general user-update path skips the password-reset authorization check that the dedicated credential-reset flow enforces. Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are the affected downstream products, and the flaw is rated 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-862). Exploitation is conditionally gated rather than internet-facing: it requires a non-default FGAP configuration and an already-provisioned semi-trusted admin holding user-profile edit rights but deliberately denied password-reset rights, making this an insider or lateral privilege-escalation issue; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Second-factor authentication bypass in Keycloak's Conditional OTP authenticator allows an attacker who already possesses a user's password to skip OTP verification by sending a crafted HTTP header, provided the realm is configured to evaluate headers for OTP-skipping without validating their source. This flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, has a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and requires a non-default configuration plus a compromised first factor, meaning it is an account-targeted MFA bypass rather than unauthenticated remote compromise. No public exploit has been identified at the time of analysis.
Keycloak's client-policy-enforced mandatory 2FA enrollment can be bypassed by an authenticated user who manually triggers a session-restart web link during the login flow, causing the internal markers tracking required authentication steps to be cleared so the session completes with only a password. The flaw only manifests in deployments where an administrator has explicitly enforced step-up/2FA setup through a client policy, and it is a self-bypass by a legitimate password holder rather than a remote compromise; the assessed vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects an integrity-only weakening of the authentication posture. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no EPSS data was supplied.
In Keycloak, a flaw in the User-Managed Access (UMA) permission-ticket flow can cause authorization scopes from two same-named resources owned by different users to be merged, allowing an authenticated attacker to obtain unintended access scopes on a victim's resource. The issue affects deployments where UMA is explicitly enabled and requires the attacker to have an account that can create resources plus a resource-name collision with the victim; it is not a default deployment mode. Independent assessment rates this low severity and confines impact to scope leakage on the specific colliding resource; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Privilege escalation in the Keycloak Admin REST API allows an already-authenticated delegated administrator to add their own account to a group that carries administrative role mappings, turning scoped, fine-grained management rights into effective control of the entire realm. The group-membership endpoints do not verify whether the target group grants privileged roles (CWE-862, Missing Authorization), so the escalation is a single API call away for anyone holding manage-users or equivalent group-scoped permissions. Reachability is limited: anonymous users and ordinary end-users cannot trigger it, a high-privilege group must already exist in the same realm, and deployments that only use a single super-admin gain nothing new because those actors are already fully privileged. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. Affected builds include Red Hat Build of Keycloak and Red Hat Single Sign-On 7.
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a targeted user by registering that user's username on a trusted external identity provider, triggering a username collision during the first-broker-login flow. Exploitation requires the affected realm to be configured for identity brokering with an external IdP and to perform account linking by username, and the attacker must know or guess the victim's Keycloak username; no credentials or victim interaction are needed. Impact is limited to denial of access for one specific user (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, CWE-287), with no data exposure or account takeover, and no public exploit has been identified at time of analysis. Fixed versions are Red Hat build of Keycloak 26.4.16 and 26.6.7.
A flaw was found in Keycloak’s WebAuthn registration component. [CVSS 3.1 LOW]
Build Of Keycloak contains a vulnerability that allows attackers to unauthorized changes to user profiles, even when the system is configured to res (CVSS 4.9).
A vulnerability was found in Keycloak-services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CVE-2025-7365 is an account takeover vulnerability in Keycloak affecting authenticated users during IdP-initiated account merging workflows. An attacker with valid authentication can manipulate the account merge process to change an email address to match a victim's email, triggering a verification email to the victim that lacks sender attribution-enabling phishing. Successful exploitation grants the attacker full account access to the victim's Keycloak account with high confidentiality, integrity, and availability impact (CVSS 7.1). No public POC or active KEV status has been confirmed at this time, but the attack requires low technical complexity and user interaction (clicking a verification link).
A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information.
A session fixation issue was discovered in the SAML adapters provided by Keycloak. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
An open redirect vulnerability was found in Keycloak. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Keycloak. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An unconstrained memory consumption vulnerability was discovered in Keycloak. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in Keycloak. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable. No vendor patch available.
A flaw was found in Keycloak. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A privilege escalation flaw was found in the token exchange feature of keycloak. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in keycloak in versions before 13.0.0. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in keycloak. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
A flaw was found in keycloak. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak in versions before 9.0.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in keycloak in versions before 9.0.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in keycloak before version 9.0.1. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in keycloak before 6.0.2. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required.
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in JBOSS Keycloak 3.2.1.Final. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Replay protection bypass in Keycloak deployed in stateless mode with a MySQL or MariaDB backend allows remote, unauthenticated attackers who have captured a still-valid single-use artifact - such as a JWT client assertion, a DPoP proof, or a TOTP code - to replay it against the token endpoint or login flow and obtain unauthorized access. The weakness is a mismatch in row-count semantics between the MySQL/MariaDB database driver and Keycloak's application logic, which silently defeats the one-time-use check; the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N, 7.4) reflects high confidentiality and integrity impact tempered by the hard configuration prerequisite and the requirement to intercept a valid artifact before it expires. At time of analysis no public exploit identified at time of analysis and the flaw has not been confirmed actively exploited (CISA KEV); the non-default stateless plus MySQL/MariaDB deployment combination, the need for a network position capable of capturing artifacts, and the narrow validity window keep practical exploitability constrained.
Privilege escalation in Red Hat Build of Keycloak allows an account already holding the realm 'impersonation' role to impersonate a realm administrator and thereby seize full administrative control over that realm, including management of users, clients, and roles. Affected builds are 26.4 before 26.4.16 and 26.6 before 26.6.7. This is an access-gated issue rather than a pre-authentication takeover: the CVSS vector (PR:H) confirms the attacker must be an authenticated, privileged sub-administrator or holder of a compromised delegated-admin credential before exploitation is possible, and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Missing authorization enforcement in the Keycloak policy enforcer lets an authenticated user bypass path-based security policies in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 deployments, gaining access to administrative or private application endpoints that the configured policies intended to protect. The flaw lies in how the enforcer normalizes request URLs containing encoded semicolons or directory-traversal segments, causing it to select a less restrictive policy than the one the backend application ultimately resolves to. Exploitation requires a valid account (even low-privileged), network reachability and an application deployed behind the policy enforcer using path-based authorization; no public exploit code was identified at time of analysis and the issue is not confirmed as actively exploited. Red Hat has published errata addressing the defect.
Authentication bypass in the Apache Airflow Keycloak auth manager provider (apache-airflow-providers-keycloak below 0.10.0) lets a remote attacker exchange credentials belonging to any confidential client in a shared Keycloak realm for a signed Airflow session token, even though those credentials have nothing to do with Airflow. The unauthenticated POST /auth/token client_credentials grant performed no allowlist check on client_id, so an unrelated application's service-account secret became a valid Airflow login; the resulting access is limited to whatever that service account is authorized for per subject, plus endpoints gated only on being authenticated. Exploitation requires a non-default topology - a Keycloak auth manager deployment whose realm is shared with at least one other confidential client - and the attacker must already hold valid credentials for one of those clients; no public exploit code has been identified at time of analysis, EPSS is low (0.19%, 9th percentile), and a vendor patch is available in provider version 0.10.0.
Privilege escalation in the Apache Airflow Keycloak auth manager (apache-airflow-providers-keycloak) affecting Airflow 3.3 and later lets an authenticated user who already holds a valid Airflow session pair it with another subject's Keycloak access or refresh token - obtained out of band via cookie theft, proxy capture or a leaked token - so Airflow authorizes their requests with the foreign token's privileges while the audit log, cache keys and session identity continue to name the attacker's own account. The official CVSS of 9.1 overstates practical risk: exploitation requires both a valid Airflow login and a genuine (not forged) Keycloak token belonging to someone else, and the opt-in Keycloak auth manager is not Airflow's default authentication backend, so the independent assessment rates this CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N rather than AV:N/AC:L/PR:N. There is no public exploit code and no confirmed active exploitation (EPSS 0.21%, 11th percentile); upgrading the provider to 0.10.0 or later restores the subject binding between session and Keycloak tokens.
Access-control bypass in Keycloak (fixed in 26.5.3) lets a disabled user account still obtain valid tokens through the JWT authorization grant preview feature. When that feature is enabled, Keycloak omits the account-enabled check during JWT authorization grant processing, so a low-privileged remote attacker who can present a valid assertion token from an external identity provider can mint a JWT for an account an administrator has explicitly disabled, regaining access to protected resources. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Keycloak's SAML identity provider broker fails to enforce client disabled status during IdP-initiated SSO flows, allowing attackers with valid credentials to establish authenticated sessions and access other enabled clients without re-authentication. An authenticated remote attacker can exploit this authentication bypass to gain unauthorized access to protected resources across the Keycloak ecosystem. No patch is currently available.
Stored cross-site scripting in the login theme rendering component of Keycloak (and its downstream Red Hat Build of Keycloak and Red Hat Single Sign-On 7 products) lets a realm administrator inject malicious JavaScript into display fields that is later executed in the browsers of users loading the affected realm's login page. Exploitation requires an authenticated realm administrator (CVSS PR:H) who can both reach the theme display fields and bypass the input-sanitizing security filter, so this is a privilege-abuse or post-compromise vector rather than an anonymous remote attack; impact is limited to the confidentiality and integrity of affected users' sessions (C:L/I:L) with no availability impact. There is no public exploit identified at time of analysis and no CISA KEV listing; overall this is a genuine but modest-priority issue rather than a high-urgency crisis.
Keycloak's Dynamic Client Registration flow fails to filter security-sensitive client attributes, allowing an authenticated attacker with a valid Initial Access Token to register a client that bypasses audience checks during token introspection. This results in read-only disclosure of sensitive identity information, roles, and session details from access tokens belonging to other applications in the same realm. The flaw is rated CVSS 6.5 and requires the target realm to have Dynamic Client Registration enabled and the attacker to possess a registration token; no public exploit code or confirmed active exploitation has been identified at time of analysis.
Keycloak's User Session Note protocol mapper fails to screen session note keys for sensitive internal credentials, allowing an authenticated delegated client administrator to copy a victim's upstream federated access/bearer token into tokens issued to the application they manage (CVSS 3.1 5.7, AV:N/AC:L/PR:L/UI:R, C:H/I:N/A:N). Exploitation requires the attacker to hold scoped client-administration rights sufficient to configure protocol mappers, a realm federated with external identity providers that persist upstream tokens as user session notes, and the victim to actually authenticate to the attacker-controlled client, so impact is decisive only in federated-token deployments and default configurations without federated token storage are not exposed. Red Hat has published an advisory and Bugzilla record for the issue, but no public exploit code and no confirmed active exploitation were identified in the available intelligence at time of analysis.
Information disclosure and denial of service in Keycloak's X.509 client certificate authenticator occur when CRL Distribution Point checking is enabled and an unauthenticated remote attacker submits a crafted client certificate. The server fails to properly validate file paths from the certificate, allowing limited local file reads and extreme memory consumption that can crash the system; exploitation requires the non-default combination of certificate-based client authentication and CRL checking, and no public exploit was identified at time of analysis.
Keycloak's Micrometer user-event metrics listener can be forced to create unbounded metric time series by unauthenticated remote requests to the identity broker login endpoint with arbitrary provider aliases, leading to memory exhaustion and performance degradation. This is a low-priority issue because exploitation requires the non-default configuration of including the 'idp' tag in the listener, and the impact is limited to a gradual availability degradation (A:L). No public exploit code has been identified at the time of analysis.
Privilege escalation in the Fine-Grained Admin Permissions v2 (FGAP v2) feature of Keycloak lets an authenticated delegated administrator with role-assignment rights grant a composite role whose transitive contents are never inspected, silently conferring full realm administrative control. Exploitation requires that FGAP v2 be enabled for delegated administration, a limited-admin credential holding role-mapping permissions (CVSS vector PR:H), and the presence of a composite role that transitively contains realm-admin privileges within that administrator's assignable scope; the high attack complexity (AC:H) reflects these preconditions rather than any exploitation difficulty, and the resulting impact is a complete confidentiality, integrity, and availability compromise of the realm (CVSS 6.6). No public exploit code and no confirmed active exploitation have been identified at time of analysis, so this should be treated as a genuine but conditional authorization-logic flaw rather than a remotely exploitable takeover.
Information disclosure in the Keycloak Admin REST API lets an authenticated delegated administrator holding only basic group/role search privileges enumerate every group assigned to a given role, including groups they are supposed to be unable to see. The flaw (CWE-862, missing authorization) affects the Admin REST API endpoints that return role-to-group mappings in Keycloak, Red Hat Build of Keycloak, and Red Hat Single Sign-On 7, and is rated CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N) - a read-only confidentiality impact with no integrity or availability effect. It requires valid, privileged-but-scoped credentials and is only meaningful where an organization actually partitions group visibility across delegated admins; there is no public exploit identified at time of analysis and the issue is not confirmed actively exploited (no CISA KEV listing).
Authenticated delegated administrators in Keycloak can reset other users' passwords and take over their accounts when Fine-Grained Admin Permissions (FGAP) are enabled, because the Admin REST API's general user-update path skips the password-reset authorization check that the dedicated credential-reset flow enforces. Red Hat Build of Keycloak and Red Hat Single Sign-On 7 are the affected downstream products, and the flaw is rated 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H, CWE-862). Exploitation is conditionally gated rather than internet-facing: it requires a non-default FGAP configuration and an already-provisioned semi-trusted admin holding user-profile edit rights but deliberately denied password-reset rights, making this an insider or lateral privilege-escalation issue; no public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis.
Second-factor authentication bypass in Keycloak's Conditional OTP authenticator allows an attacker who already possesses a user's password to skip OTP verification by sending a crafted HTTP header, provided the realm is configured to evaluate headers for OTP-skipping without validating their source. This flaw affects Red Hat Build of Keycloak and Red Hat Single Sign-On 7, has a CVSS score of 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N), and requires a non-default configuration plus a compromised first factor, meaning it is an account-targeted MFA bypass rather than unauthenticated remote compromise. No public exploit has been identified at the time of analysis.
Keycloak's client-policy-enforced mandatory 2FA enrollment can be bypassed by an authenticated user who manually triggers a session-restart web link during the login flow, causing the internal markers tracking required authentication steps to be cleared so the session completes with only a password. The flaw only manifests in deployments where an administrator has explicitly enforced step-up/2FA setup through a client policy, and it is a self-bypass by a legitimate password holder rather than a remote compromise; the assessed vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) reflects an integrity-only weakening of the authentication posture. No public exploit code was identified at time of analysis and the issue is not confirmed actively exploited (CISA KEV); no EPSS data was supplied.
In Keycloak, a flaw in the User-Managed Access (UMA) permission-ticket flow can cause authorization scopes from two same-named resources owned by different users to be merged, allowing an authenticated attacker to obtain unintended access scopes on a victim's resource. The issue affects deployments where UMA is explicitly enabled and requires the attacker to have an account that can create resources plus a resource-name collision with the victim; it is not a default deployment mode. Independent assessment rates this low severity and confines impact to scope leakage on the specific colliding resource; no public exploit code and no confirmed active exploitation were identified at time of analysis.
Privilege escalation in the Keycloak Admin REST API allows an already-authenticated delegated administrator to add their own account to a group that carries administrative role mappings, turning scoped, fine-grained management rights into effective control of the entire realm. The group-membership endpoints do not verify whether the target group grants privileged roles (CWE-862, Missing Authorization), so the escalation is a single API call away for anyone holding manage-users or equivalent group-scoped permissions. Reachability is limited: anonymous users and ordinary end-users cannot trigger it, a high-privilege group must already exist in the same realm, and deployments that only use a single super-admin gain nothing new because those actors are already fully privileged. No public exploit code has been identified at time of analysis and the CVE is not listed in CISA KEV. Affected builds include Red Hat Build of Keycloak and Red Hat Single Sign-On 7.
Account lockout in the Red Hat build of Keycloak 26.4 and 26.6 lets an unauthenticated remote attacker deny access to a targeted user by registering that user's username on a trusted external identity provider, triggering a username collision during the first-broker-login flow. Exploitation requires the affected realm to be configured for identity brokering with an external IdP and to perform account linking by username, and the attacker must know or guess the victim's Keycloak username; no credentials or victim interaction are needed. Impact is limited to denial of access for one specific user (CVSS 5.3, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:L, CWE-287), with no data exposure or account takeover, and no public exploit has been identified at time of analysis. Fixed versions are Red Hat build of Keycloak 26.4.16 and 26.6.7.
A flaw was found in Keycloak’s WebAuthn registration component. [CVSS 3.1 LOW]
Build Of Keycloak contains a vulnerability that allows attackers to unauthorized changes to user profiles, even when the system is configured to res (CVSS 4.9).
A vulnerability was found in Keycloak-services. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
CVE-2025-7365 is an account takeover vulnerability in Keycloak affecting authenticated users during IdP-initiated account merging workflows. An attacker with valid authentication can manipulate the account merge process to change an email address to match a victim's email, triggering a verification email to the victim that lacks sender attribution-enabling phishing. Successful exploitation grants the attacker full account access to the victim's Keycloak account with high confidentiality, integrity, and availability impact (CVSS 7.1). No public POC or active KEV status has been confirmed at this time, but the attack requires low technical complexity and user interaction (clicking a verification link).
A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information.
A session fixation issue was discovered in the SAML adapters provided by Keycloak. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable. No vendor patch available.
An open redirect vulnerability was found in Keycloak. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Keycloak. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and EPSS exploitation probability 53.6%.
A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An unconstrained memory consumption vulnerability was discovered in Keycloak. Rated high severity (CVSS 7.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in Keycloak. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable. No vendor patch available.
A flaw was found in Keycloak. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A privilege escalation flaw was found in the token exchange feature of keycloak. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could lead to a DoS attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in keycloak in versions before 13.0.0. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in keycloak. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. No vendor patch available.
A flaw was found in keycloak. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. Rated medium severity (CVSS 6.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Allocation of Resources Without Limits vulnerability could allow attackers to exhaust system resources through uncontrolled allocation.
A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. Rated medium severity (CVSS 5.9), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in Keycloak in versions before 9.0.2. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A flaw was found in keycloak in versions before 9.0.0. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in keycloak before version 9.0.1. Rated medium severity (CVSS 5.6), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. No vendor patch available.
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A vulnerability was found in keycloak before 6.0.2. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, no authentication required.
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. Rated low severity (CVSS 3.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in JBOSS Keycloak 3.2.1.Final. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity.
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. Rated medium severity (CVSS 4.9), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Uncontrolled Resource Consumption vulnerability could allow attackers to cause denial of service by exhausting system resources.
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity.
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This HTTP Request/Response Smuggling vulnerability could allow attackers to manipulate HTTP request interpretation between frontend and backend servers.
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.