org.keycloak:keycloak-core (Maven)
Advisories
59
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 26.0.6 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-core</artifactId><version>26.0.6</version></dependency>gradle
implementation("org.keycloak:keycloak-core:26.0.6")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-q4xq-445g-g6ch Keycloak allows cross-site scripting (XSS) |
Low EPSS 0.30% |
<= 26.1.2 | No fix yet |
| GHSA-93ww-43rr-79v3 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination |
High | < 26.0.6 | 26.0.6 |
| GHSA-w97f-w3hq-36g2 Keycloak Denial of Service vulnerability |
High EPSS 0.74% |
< 24.0.0 | 24.0.0 |
| GHSA-57rh-gr4v-j5f6 Duplicate Advisory: Keycloak Uses a Key Past its Expiration Date Withdrawn |
Medium | < 24.0.7 | 24.0.7 |
| GHSA-xmmm-jw76-q7vg Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity |
Medium EPSS 0.39% |
>= 25.0.0, < 25.0.4 | 25.0.4 |
| GHSA-xmmm-jw76-q7vg Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity |
Medium EPSS 0.39% |
< 24.0.7 | 24.0.7 |
| GHSA-g4gc-rh26-m3p5 Keycloak Open Redirect vulnerability |
Medium EPSS 0.58% |
< 24.0.7 | 24.0.7 |
| GHSA-gmrm-8fx4-66x7 Duplicate Advisory: Keycloak: Leak of configured LDAP bind credentials Withdrawn |
Low | <= 24.0.5 | No fix yet |
| GHSA-3hrr-xwvg-hxvr Duplicate Advisory: Keycloak DoS via account lockout Withdrawn |
Low | < 24.0.0 | 24.0.0 |
| GHSA-9vm7-v8wj-3fqw keycloak-core: open redirect via "form_post.jwt" JARM response mode |
Medium EPSS 1.11% |
< 23.0.4 | 23.0.4 |
| GHSA-5q66-v53q-pm35 Keycloak vulnerable to Plaintext Storage of User Password |
High EPSS 0.57% |
>= 22.0.2, < 22.0.3 | 22.0.3 |
| GHSA-c892-cwq6-qrqf Duplicate Advisory: Keycloak vulnerable to untrusted certificate validation Withdrawn |
Medium | <= 21.1.1 | No fix yet |
| GHSA-5cc8-pgp5-7mpm Keycloak Untrusted Certificate Validation vulnerability |
Medium EPSS 0.43% |
< 21.1.2 | 21.1.2 |
| GHSA-vhvq-jh34-3fc8 Duplicate Advisory: Keycloak allows impersonation and lockout due to email trust not being handled correctly Withdrawn |
Medium | <= 20.0.2 | No fix yet |
| GHSA-c7xw-p58w-h6fj Keycloak: Impersonation and lockout possible through incorrect handling of email trust |
Medium EPSS 0.72% |
< 22.0.1 | 22.0.1 |
| GHSA-v436-q368-hvgg Keycloak has lack of validation of access token on client registrations endpoint |
Low EPSS 0.48% |
< 20.0.3 | 20.0.3 |
| GHSA-w8v7-c7pm-7wfr Duplicate Advisory: Keycloak vulnerable to Cross-Site Scripting (XSS) Withdrawn |
Medium | <= 19.0.1 | No fix yet |
| GHSA-j9xq-j329-2xvg Duplicate Advisory: Keycloak user may register themselves with same email ID of any existing user Withdrawn |
Medium | <= 19.0.1 | No fix yet |
| GHSA-3w4v-rvc4-2xpw Keycloak has Files or Directories Accessible to External Parties |
Medium EPSS 1.16% |
< 15.1.0 | 15.1.0 |
| GHSA-qpq9-jpv4-6gwr Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow |
High EPSS 1.16% |
< 15.1.0 | 15.1.0 |
| GHSA-755v-r4x4-qf7m Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown |
Medium EPSS 3.20% |
<= 16.1.0 | No fix yet |
| GHSA-755v-r4x4-qf7m Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown |
Medium EPSS 3.20% |
< 20.0.0 | 20.0.0 |
| GHSA-rpj2-w6fr-79hc Keycloak vulnerable to Improper Certificate Validation |
Medium EPSS 0.35% |
< 14.0.0 | 14.0.0 |
| GHSA-pcv5-m2wh-66j3 Keycloak discloses information without authentication |
Medium EPSS 17.87% |
< 13.0.0 | 13.0.0 |
| GHSA-jh7q-5mwf-qvhw Keycloak vulnerable to Server-Side Request Forgery |
Medium EPSS 69.72% |
< 13.0.0 | 13.0.0 |
| GHSA-8xj2-47xw-q78c Keycloak Insufficient Session Expiry |
Medium EPSS 0.82% |
< 9.0.2 | 9.0.2 |
| GHSA-qgmm-f2qw-r95f Keycloak leaks sensitive information in logged exceptions |
Medium EPSS 0.37% |
< 9.0.0 | 9.0.0 |
| GHSA-9695-w6h2-jpv9 Keycloak users may be able to remove MFA from other users' devices |
Medium EPSS 0.65% |
< 9.0.2 | 9.0.2 |
| GHSA-cf8f-w2c5-p5jr keycloak vulnerable to unauthorized login via mail server setup |
Critical EPSS 1.72% |
< 8.0.0 | 8.0.0 |
| GHSA-px42-mr8m-cpgh JBoss KeyCloak Cross-site Scripting Vulnerability |
Medium EPSS 0.77% |
< 1.1.0.Beta1 | 1.1.0.Beta1 |
| GHSA-3qh2-mccc-q5m6 Keycloak Open Redirect |
Medium EPSS 1.10% |
<= 3.2.1.Final | No fix yet |
| GHSA-f32v-vf79-p29q Improper authorization in Keycloak |
Medium EPSS 1.10% |
< 17.0.1 | 17.0.1 |
| GHSA-xpgc-j48j-jwv9 Cross-site Scripting in Keycloak |
Medium EPSS 37.25% |
>= 15.0.0, < 17.0.0 | 17.0.0 |
| GHSA-m9cj-v55f-8x26 Authentication Bypass in keycloak |
High EPSS 0.57% |
< 12.0.0 | 12.0.0 |
| GHSA-6xp6-fmc8-pmmr Temporary Directory Hijacking Vulnerability in Keycloak |
High EPSS 0.30% |
< 13.0.0 | 13.0.0 |
| GHSA-m6mm-q862-j366 Improper Input Validation in Keycloak |
High EPSS 2.60% |
< 11.0.0 | 11.0.0 |
| GHSA-c9x9-xv66-xp3v Improper privilege management in Keycloak |
High EPSS 0.82% |
< 12.0.0 | 12.0.0 |
| GHSA-7m27-3587-83xf Privilege Defined With Unsafe Actions in Keycloak |
High EPSS 1.15% |
< 8.0.0 | 8.0.0 |
| GHSA-4gf2-xv97-63m2 Exposure of Sensitive Information in keycloak |
Medium EPSS 1.13% |
< 9.0.1 | 9.0.1 |
| GHSA-q6w2-89hq-hq27 keycloak Self Stored Cross-site Scripting vulnerability |
Critical EPSS 1.25% |
< 13.0.0 | 13.0.0 |
| GHSA-xf46-8vvp-4hxx Keycloak Missing authentication for critical function |
Medium EPSS 0.33% |
<= 12.0.4 | No fix yet |
| GHSA-3gg7-9q2x-79fc Improper Restriction of Rendered UI Layers or Frames in Keycloak |
Medium EPSS 0.78% |
<= 9.0.3 | No fix yet |
| GHSA-6pmv-7pr9-cgrj Predictable password in Keycloak |
Critical EPSS 1.28% |
< 8.0.2 | 8.0.2 |
| GHSA-8vf3-4w62-m3pq XSS in Keycloak |
Medium EPSS 0.76% |
< 9.0.0 | 9.0.0 |
| GHSA-xfqh-7356-vqjj Exposure of Sensitive Information to an Unauthorized Actor in Keycloak |
Medium EPSS 0.72% |
< 8.0.0 | 8.0.0 |
| GHSA-p5xp-6vpf-jwvh Improper Input Validation and Cross-Site Request Forgery in Keycloak |
High EPSS 0.50% |
< 7.0.0 | 7.0.0 |
| GHSA-4fgq-gq9g-3rw7 Improper Verification of Cryptographic Signature in keycloak |
High EPSS 0.71% |
< 7.0.0 | 7.0.0 |
| GHSA-38cg-gg9j-q9j9 Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak |
Medium EPSS 0.29% |
<= 6.0.1 | No fix yet |
| GHSA-gc52-xj6p-9pxp Exposure of Sensitive Information to an Unauthorized Actor in Keycloak |
Low EPSS 1.00% |
< 6.0.0 | 6.0.0 |
| GHSA-gf2j-7qwg-4f5x Improper Authentication in Keycloak |
High EPSS 0.81% |
< 4.6.0 | 4.6.0 |
| GHSA-r32r-3977-cgc3 Keycloak vulnerable to uncontrolled resource consumption |
High EPSS 1.63% |
< 1.0.3 | 1.0.3 |
| GHSA-959q-32g8-vvp7 Moderate severity vulnerability that affects org.keycloak:keycloak-core |
Medium EPSS 1.31% |
< 3.4.2 | 3.4.2 |
| GHSA-h7j7-pw3v-3v3x Moderate severity vulnerability that affects org.keycloak:keycloak-core |
Medium EPSS 1.31% |
< 4.0.0 | 4.0.0 |
| GHSA-c77r-6f64-478q keycloak-core discloses system properties |
Medium EPSS 2.43% |
< 2.5.1 | 2.5.1 |
| GHSA-jc6q-27mw-p55w Keycloak vulnerable to infinite loop based Denial of Service |
High EPSS 1.83% |
< 2.5.5 | 2.5.5 |
| GHSA-95m6-mjh3-58gm Improper Authentication in org.keycloak:keycloak-core |
High EPSS 1.68% |
< 2.3.0 | 2.3.0 |
| GHSA-qgm9-232x-hwpx Moderate severity vulnerability that affects org.keycloak:keycloak-core Withdrawn |
Medium | < 2.0.0 | 2.0.0 |
| GHSA-778x-2mqv-w6xw Moderate severity vulnerability that affects org.keycloak:keycloak-core |
Medium EPSS 1.90% |
< 2.4.0 | 2.4.0 |
| GHSA-w6gv-3r3v-gwgj keycloak-core vulnerable to timing attacks against JWS token verification |
Medium EPSS 1.97% |
< 2.5.1 | 2.5.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor