keycloak
66 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-7307 | < 26.2.16 ; < 26.4.12 ; < 26.6.2 | Keycloak: keycloak: denial of service via specially crafted saml input | HIGH 7.5 | 0.9 % | ||
| CVE-2025-11419 | < 26.0.16 ; 26.2.0 – < 26.2.10 ; 26.4.0 – < 26.4.1 | Keycloak: keycloak tls client-initiated renegotiation denial of service | HIGH 7.5 | 0.7 % | ||
| CVE-2025-7784 | < 26.2.6 | Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled) | MEDIUM 6.5 | 0.5 % | ||
| CVE-2025-7365 | < 26.0.13 ; 26.2.0 – < 26.2.6 | Keycloak: phishing attack via email verification step in first login flow | HIGH 7.1 | 0.3 % | ||
| CVE-2025-3910 | 25.0.0 – < 25.* ; 26.0.0 – < 26.0.11 ; 26.2.0 – < 26.2.2 | Org.keycloak.authentication: two factor authentication bypass | MEDIUM 5.4 | 0.4 % | ||
| CVE-2025-3501 | 25.0.0 – < 25.* ; 26.0.0 – < 26.0.11 ; 26.2.0 – < 26.2.2 | Org.keycloak.protocol.services: keycloak hostname verification | HIGH 8.2 | 0.5 % | ||
| CVE-2025-2559 | 23.0.0 – < 26.0.11 ; 26.1.0 – < 26.1.5 | Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak | MEDIUM 4.9 | 0.7 % | ||
| CVE-2024-4028 | 18.0.8 – < 18.0.8 | Keycloak-core: stored xss in keycloak when creating a items in admin console | LOW 3.8 | 0.3 % | ||
| CVE-2024-11736 | < 26.0.8 | Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables | MEDIUM 4.9 | 0.8 % | ||
| CVE-2024-11734 | < 26.0.8 | Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers | MEDIUM 6.5 | 0.9 % | ||
| CVE-2024-10973 | fixed in 26.0.6 | Keycloak: cli option for encrypted jgroups ignored | MEDIUM 5.7 | 0.3 % | ||
| CVE-2024-10492 | < 26.0.6 | Keycloak-quarkus-server: keycloak path trasversal | LOW 2.7 | 0.7 % | ||
| CVE-2024-10270 | < 24.0.9 ; 25.0.0 – < 26.0.6 | Org.keycloak:keycloak-services: keycloak denial of service | MEDIUM 6.5 | 1.2 % | ||
| CVE-2024-9666 | < 24.0.9 ; 25.0.0 – < 26.0.6 | Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability | MEDIUM 4.7 | 0.4 % | ||
| CVE-2023-0657 | < 22.0.10 ; 23.0.0 – < 24.0.3 | Keycloak: impersonation via logout token exchange | LOW 3.4 | 0.3 % | ||
| CVE-2024-3656 | < 24.0.5 | Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities | HIGH 8.1 | 3.3 % | ||
| CVE-2024-8698 | < 25.0.5 | Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak | HIGH 7.7 | 2.0 % | ||
| CVE-2023-6841 | < 24.0.0 | Keycloak: amount of attributes per object is not limited and it may lead to dos | HIGH 7.5 | 0.7 % | ||
| CVE-2024-7260 | < 24.0.7 | Keycloak-core: open redirect on account page | MEDIUM 6.1 | 0.6 % | ||
| CVE-2024-4629 | 24.0.3 | Keycloak: potential bypass of brute force protection | MEDIUM 6.5 | 0.8 % | ||
| CVE-2024-5967 | < 22.0.12 ; 23.0.0 – < 24.0.6 ; 25.0.0 – < 25.0.1 | Keycloak: leak of configured ldap bind credentials through the keycloak admin console | LOW 2.7 | 0.6 % | ||
| CVE-2023-4727 | < 11.5.1 | Ca: token authentication bypass vulnerability | HIGH 7.5 | 0.7 % | ||
| CVE-2024-4540 | | Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie | HIGH 7.5 | 0.6 % | ||
| CVE-2023-6787 | < 22.0.10 ; < 24.0.3 | Keycloak: session hijacking via re-authentication | HIGH 8.8 | 0.7 % | ||
| CVE-2023-6717 | < 22.0.10 ; 24.0.0 – < 24.0.3 | Keycloak: xss via assertion consumer service url in saml post-binding flow | MEDIUM 6.0 | 0.7 % | ||
| CVE-2023-6484 | < 22.0.9 ; 23.0.0 – < 23.0.5 | Keycloak: log injection during webauthn authentication or registration | MEDIUM 5.3 | 1.0 % | ||
| CVE-2023-3597 | < 22.0.10 ; 23.0.0 – < 24.0.3 | Keycloak: secondary factor bypass in step-up authentication | MEDIUM 5.0 | 0.6 % | ||
| CVE-2024-2419 | < 22.0.10 ; 23.0.0 – < 24.0.3 | Keycloak: path traversal in the redirect validation | HIGH 7.1 | 0.5 % | ||
| CVE-2024-1249 | 21.1.0 – < 22.0.10 ; 23.0.0 – < 24.0.3 | Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos | HIGH 7.4 | 0.4 % | ||
| CVE-2024-1132 | 21.1.0 – < 22.0.10 ; 23.0.0 – < 24.0.3 | Keycloak: path transversal in redirection validation | HIGH 8.1 | 1.6 % | ||
| CVE-2023-4918 | fixed in 22.0.3 | Plaintext storage of user password | HIGH 8.8 | 0.6 % | ||
| CVE-2023-1664 | NA | A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse | MEDIUM 6.5 | 0.4 % | ||
| CVE-2022-1274 | unknown | A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keyc | MEDIUM 5.4 | 0.7 % | ||
| CVE-2022-2237 | unknown | A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSs | MEDIUM 6.1 | 0.4 % | ||
| CVE-2022-2256 | keycloak as shipped in Red Hat Single Sign-On 7 | A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privilege | LOW 3.8 | 0.7 % | ||
| CVE-2022-0225 | Not-Known | A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new gro | MEDIUM 5.4 | 3.2 % | ||
| CVE-2021-3632 | Fixed in v15.1.0 | A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already r | HIGH 7.5 | 1.2 % | ||
| CVE-2021-3754 | Not-Known | A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This | MEDIUM 5.3 | 2.2 % | ||
| CVE-2021-3856 | Fixed in 15.1.0 | ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending re | MEDIUM 4.3 | 1.2 % | ||
| CVE-2020-35509 | 11.0.3, 12.0.0 | A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticato | MEDIUM 5.4 | 0.4 % | ||
| CVE-2021-3827 | Fixed in v18.0.0 | A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavi | MEDIUM 6.8 | 1.1 % | ||
| CVE-2021-3513 | Fixed in keycloak v13.0.0. | A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wro | HIGH 7.5 | 0.8 % | ||
| CVE-2022-2668 | Keycloak 18 | An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS | HIGH 7.2 | 1.0 % | ||
| CVE-2022-1245 | keycloak versions prior to 18.0.0 | A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a | CRITICAL 9.8 | 1.4 % | ||
| CVE-2021-3461 | rh-sso7-keycloak 9.0.13 | A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider | HIGH 7.1 | 0.3 % | ||
| CVE-2021-4133 | keycloak 15.1.1 | A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new | HIGH 8.8 | 1.4 % | ||
| CVE-2021-3424 | as shipped in Red Hat Single Sign-On 7.4 | A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can registe | MEDIUM 5.3 | 0.8 % | ||
| CVE-2021-20195 | keycloak 13.0.0 | A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possibl | CRITICAL 9.6 | 1.2 % | ||
| CVE-2020-27826 | keycloak 12.0.0 | A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. Thi | MEDIUM 4.2 | 0.6 % | ||
| CVE-2021-20202 | keycloak 13.0.0 | A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider | HIGH 7.3 | 0.3 % | ||
| CVE-2021-20222 | keycloak 13.0.0 | A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highes | HIGH 7.5 | 1.2 % | ||
| CVE-2021-20262 | Keycloak 12.0.0 | A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take | MEDIUM 6.8 | 0.3 % | ||
| CVE-2020-27838 | keycloak 13.0.0 | A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients | MEDIUM 6.5 | 18 % | ||
| CVE-2020-14359 | all versions as of 2021-02-22 | A vulnerability was found in all versions of Keycloak Gatekeeper, where on using lower case HTTP headers (via cURL) an attacker can bypass o | HIGH 7.3 | 0.9 % | ||
| CVE-2020-10734 | As shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes | A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat | LOW 3.3 | 0.2 % | ||
| CVE-2020-1717 | keycloak 7.0.1 | A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack. | LOW 2.7 | 0.8 % | ||
| CVE-2020-1725 | keycloak 13.0.0 | A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings | MEDIUM 5.4 | 0.7 % | ||
| CVE-2020-14302 | keycloak 13.0.0 | A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak end | MEDIUM 4.9 | 1.0 % | ||
| CVE-2020-10770 | keycloak 13.0.0 | A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter | MEDIUM 5.3 | 70 % | ||
| CVE-2020-10776 | before version 12.0.0 | A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw all | MEDIUM 4.8 | 0.8 % | ||
| CVE-2020-14389 | before version 12.0.0 | It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account | HIGH 8.1 | 0.8 % | ||
| CVE-2020-1694 | all versions before 10.0.0 | A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw re | MEDIUM 4.9 | 1.6 % | ||
| CVE-2020-10748 | keycloak 10.0.1 | A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw | MEDIUM 6.1 | 0.9 % | ||
| CVE-2020-10758 | Keycloak before 11.0.1 | A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified | HIGH 7.5 | 1.9 % | ||
| CVE-2019-14910 | n/a | A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS fro | CRITICAL 9.8 | 1.1 % | ||
| CVE-2019-14909 | n/a | A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or v | CRITICAL 9.3 | 1.1 % |