org.keycloak:keycloak-services (Maven)
Advisories
179
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 26.7.2 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-services</artifactId><version>26.7.2</version></dependency>gradle
implementation("org.keycloak:keycloak-services:26.7.2")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-v3f7-2p4r-mwfw Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass |
High EPSS 0.78% |
< 26.6.4 | 26.6.4 |
| GHSA-v3f7-2p4r-mwfw Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass |
High EPSS 0.78% |
< 26.6.4 | 26.6.4 |
| GHSA-9jrw-8xf7-xqhq Keycloak vulnerable to information disclosure through arbitrary filesystem path probing |
Medium EPSS 0.78% |
< 26.6.4 | 26.6.4 |
| GHSA-9jrw-8xf7-xqhq Keycloak vulnerable to information disclosure through arbitrary filesystem path probing |
Medium EPSS 0.78% |
< 26.6.4 | 26.6.4 |
| GHSA-w3p3-7cjg-vgfw Keycloak allows unauthorized access to resources via uma permission ticket bypass |
Medium EPSS 0.29% |
< 26.6.4 | 26.6.4 |
| GHSA-w3p3-7cjg-vgfw Keycloak allows unauthorized access to resources via uma permission ticket bypass |
Medium EPSS 0.29% |
< 26.6.4 | 26.6.4 |
| GHSA-f5p5-6xmx-p252 Keycloak vulnerable to authorization bypass via incorrect uri comparison |
High EPSS 0.65% |
< 26.6.4 | 26.6.4 |
| GHSA-f5p5-6xmx-p252 Keycloak vulnerable to authorization bypass via incorrect uri comparison |
High EPSS 0.65% |
< 26.6.4 | 26.6.4 |
| GHSA-r7rc-c989-86g6 Keycloak: Attacker can re-enable and take over disabled clients via registration access token |
Medium EPSS 0.46% |
< 26.6.4 | 26.6.4 |
| GHSA-r7rc-c989-86g6 Keycloak: Attacker can re-enable and take over disabled clients via registration access token |
Medium EPSS 0.46% |
< 26.6.4 | 26.6.4 |
| GHSA-4gv3-mc9p-5wqc Keycloak: Unauthenticated account takeover via reset-credentials flow bypass |
Critical EPSS 4.68% |
>= 26.7.0, < 26.7.2 | 26.7.2 |
| GHSA-4gv3-mc9p-5wqc Keycloak: Unauthenticated account takeover via reset-credentials flow bypass |
Critical EPSS 4.68% |
>= 26.0.0, < 26.4.15 | 26.4.15 |
| GHSA-4gv3-mc9p-5wqc Keycloak: Unauthenticated account takeover via reset-credentials flow bypass |
Critical EPSS 4.68% |
>= 26.5.0, < 26.6.6 | 26.6.6 |
| GHSA-37j9-56gh-j2r7 Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass Withdrawn |
High | all versions | No fix yet |
| GHSA-37j9-56gh-j2r7 Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass Withdrawn |
High | < 26.6.4 | 26.6.4 |
| GHSA-gfv4-4vr2-rr4g Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass Withdrawn |
Medium | < 26.6.4 | 26.6.4 |
| GHSA-79qw-g39g-mfxc Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison Withdrawn |
High | < 26.6.4 | 26.6.4 |
| GHSA-79qw-g39g-mfxc Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison Withdrawn |
High | all versions | No fix yet |
| GHSA-q929-g23j-2rc7 Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token Withdrawn |
Medium | all versions | No fix yet |
| GHSA-q929-g23j-2rc7 Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token Withdrawn |
Medium | < 26.6.4 | 26.6.4 |
| GHSA-7pm9-g8jh-3m74 Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing Withdrawn |
Medium | all versions | No fix yet |
| GHSA-7pm9-g8jh-3m74 Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing Withdrawn |
Medium | < 26.6.4 | 26.6.4 |
| GHSA-gfv4-4vr2-rr4g Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass Withdrawn |
Medium | all versions | No fix yet |
| GHSA-6g26-7cx5-mrrg Keycloak: Information disclosure due to user profile permission bypass |
Low EPSS 0.35% |
< 26.7.0 | 26.7.0 |
| GHSA-8hcx-p7m8-gc28 Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement Withdrawn |
High | < 26.6.4 | 26.6.4 |
| GHSA-cpf7-j4cf-vqx4 Keycloak has an Out-of-bounds Read |
Medium EPSS 0.42% |
<= 26.4.7 | No fix yet |
| GHSA-cpf7-j4cf-vqx4 Keycloak has an Out-of-bounds Read |
Medium EPSS 0.42% |
>= 26.5.0, < 26.6.3 | 26.6.3 |
| GHSA-v5g5-wwmp-jppw Keycloak has Insufficient Session Expiration |
Medium EPSS 0.30% |
<= 26.4.7 | No fix yet |
| GHSA-v5g5-wwmp-jppw Keycloak has Insufficient Session Expiration |
Medium EPSS 0.30% |
>= 26.5.0, < 26.6.3 | 26.6.3 |
| GHSA-q6h7-xxp7-7429 Keycloak has an Authentication Bypass by Primary Weakness |
Medium EPSS 0.38% |
<= 26.4.7 | No fix yet |
| GHSA-q6h7-xxp7-7429 Keycloak has an Authentication Bypass by Primary Weakness |
Medium EPSS 0.38% |
>= 26.5.0, <= 26.6.4 | No fix yet |
| GHSA-32h4-44jj-c5vx Keycloak has privilege escalation via improper scope mapping enforcement |
High EPSS 0.35% |
< 26.6.4 | 26.6.4 |
| GHSA-fqjh-8322-vgrv Keycloak Generates an Error Message Containing Sensitive Information |
Medium EPSS 0.44% |
<= 26.4.7 | No fix yet |
| GHSA-fqjh-8322-vgrv Keycloak Generates an Error Message Containing Sensitive Information |
Medium EPSS 0.44% |
>= 26.5.0, < 26.6.3 | 26.6.3 |
| GHSA-p3v8-fm5p-v84h Keycloak has an Improper Verification of Cryptographic Signature issue |
High EPSS 0.16% |
<= 26.6.4 | No fix yet |
| GHSA-33j3-g875-37rp Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege |
Medium EPSS 0.27% |
<= 26.4.7 | No fix yet |
| GHSA-33j3-g875-37rp Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege |
Medium EPSS 0.27% |
>= 26.5.0, < 26.6.3 | 26.6.3 |
| GHSA-4q93-v92x-p89f Keycloak Vulnerable to Incorrect Authorization |
Medium EPSS 0.21% |
>= 26.5.0, < 26.6.3 | 26.6.3 |
| GHSA-4q93-v92x-p89f Keycloak Vulnerable to Incorrect Authorization |
Medium EPSS 0.21% |
<= 26.4.7 | No fix yet |
| GHSA-rr5q-3xwr-f323 Keycloak Vulnerable to Improper Validation of Specified Quantity in Input |
High EPSS 0.32% |
< 26.6.3 | 26.6.3 |
| GHSA-wcvj-vpvw-9rr5 Keycloak Services has Improper Validation of Consistency within Input |
Medium EPSS 0.32% |
>= 26.5.0, <= 26.6.4 | No fix yet |
| GHSA-wcvj-vpvw-9rr5 Keycloak Services has Improper Validation of Consistency within Input |
Medium EPSS 0.32% |
<= 26.4.7 | No fix yet |
| GHSA-m6qj-3mpp-57v8 Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromise |
High EPSS 0.31% |
< 26.6.3 | 26.6.3 |
| GHSA-hq3p-w4xv-x7vp Keycloak: Access token disclosure and implicit flow bypass via forged client data |
High EPSS 0.41% |
< 26.6.2 | 26.6.2 |
| GHSA-hf67-5vvq-fm3r Keycloak: Session fixation in OIDC login flow that can lead to account takeover |
High EPSS 0.84% |
< 26.6.2 | 26.6.2 |
| GHSA-rp95-xpg9-c2cq Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak |
High EPSS 0.50% |
< 26.6.2 | 26.6.2 |
| GHSA-c739-f6xw-6pv2 Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers |
Medium EPSS 0.30% |
< 26.6.2 | 26.6.2 |
| GHSA-w4p5-rfh6-cwrv Keycloak: Unauthorized account takeover via WebAuthn token replay |
Medium EPSS 0.44% |
< 26.6.2 | 26.6.2 |
| GHSA-933f-rg6j-f46p Keycloak Account Resources user lookup contains broken access control |
Medium EPSS 0.37% |
< 26.4.12 | 26.4.12 |
| GHSA-933f-rg6j-f46p Keycloak Account Resources user lookup contains broken access control |
Medium EPSS 0.37% |
>= 26.5.0, < 26.6.2 | 26.6.2 |
| GHSA-4x37-hw65-52w8 Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass |
Medium EPSS 0.37% |
< 26.6.2 | 26.6.2 |
| GHSA-rrv7-3mqf-hxfr Keycloak: Information Disclosure via evaluate-scopes Admin API |
Medium EPSS 0.43% |
< 26.6.2 | 26.6.2 |
| GHSA-83c4-ffjp-mxp9 Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured |
Medium EPSS 0.28% |
<= 26.6.2 | No fix yet |
| GHSA-g8vr-x4qh-25qg Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation |
Medium EPSS 0.39% |
< 26.6.3 | 26.6.3 |
| GHSA-hm32-hfmw-rhvg Keycloak has a Forced Browsing issue |
Medium EPSS 0.23% |
<= 26.6.1 | No fix yet |
| GHSA-m32f-8vh9-2hh3 Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page |
Medium EPSS 0.36% |
<= 26.5.5 | No fix yet |
| GHSA-5v8v-xvjv-57x7 Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim |
Medium EPSS 0.25% |
>= 26.5.0, < 26.6.3 | 26.6.3 |
| GHSA-5v8v-xvjv-57x7 Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim |
Medium EPSS 0.25% |
< 26.4.13 | 26.4.13 |
| GHSA-f2hx-5fx3-hmcv Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants |
High EPSS 0.44% |
< 26.5.7 | 26.5.7 |
| GHSA-h4wv-g838-66g3 Keycloak: Application-Level DoS via Scope Processing |
High EPSS 0.64% |
< 26.5.7 | 26.5.7 |
| GHSA-rx66-hj7g-28h7 Keycloak: Replay of action tokens via improper handling of single-use entries |
Medium EPSS 0.26% |
< 26.5.7 | 26.5.7 |
| GHSA-hj93-h7pg-fh6v Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw |
High EPSS 0.43% |
< 26.5.7 | 26.5.7 |
| GHSA-cjm2-j6cm-6p6m Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint |
High EPSS 0.45% |
< 26.5.7 | 26.5.7 |
| GHSA-q35r-vvhv-vx5h Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure |
Medium EPSS 0.33% |
< 26.5.6 | 26.5.6 |
| GHSA-7xf9-4jfc-wgm4 Keycloak: manage-clients permission escalates to full realm admin access |
High EPSS 0.48% |
< 26.5.6 | 26.5.6 |
| GHSA-22rm-wp4x-v5cx Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation |
Low EPSS 0.35% |
>= 26.5.0, < 26.6.3 | 26.6.3 |
| GHSA-22rm-wp4x-v5cx Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation |
Low EPSS 0.35% |
< 26.4.13 | 26.4.13 |
| GHSA-rhgq-f8x5-j2jc Keycloak's identity-first login flow exposes user information |
Low EPSS 0.42% |
>= 26.5.0, < 26.6.1 | 26.6.1 |
| GHSA-rhgq-f8x5-j2jc Keycloak's identity-first login flow exposes user information |
Low EPSS 0.42% |
< 26.4.12 | 26.4.12 |
| GHSA-4pgc-gfrr-wcmg Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false |
Medium EPSS 0.26% |
<= 26.6.0 | No fix yet |
| GHSA-xv6h-r36f-3gp5 Keycloak: Denial of Service due to excessive SAMLRequest decompression |
Medium EPSS 0.65% |
< 26.5.4 | 26.5.4 |
| GHSA-wmxr-6j5f-838p Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions Withdrawn |
High | < 26.2.14 | 26.2.14 |
| GHSA-wmxr-6j5f-838p Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions Withdrawn |
High | >= 26.5.0, < 26.5.5 | 26.5.5 |
| GHSA-wmxr-6j5f-838p Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions Withdrawn |
High | >= 26.3.0, < 26.4.10 | 26.4.10 |
| GHSA-x4p7-7chp-64hq Keycloak: Unauthorized authentication via disabled SAML Identity Provider |
High EPSS 0.44% |
< 26.5.5 | 26.5.5 |
| GHSA-794g-x443-36f7 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions |
High EPSS 0.38% |
<= 26.2.5 | No fix yet |
| GHSA-794g-x443-36f7 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions |
High EPSS 0.38% |
>= 26.5.0, < 26.5.5 | 26.5.5 |
| GHSA-794g-x443-36f7 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions |
High EPSS 0.38% |
>= 26.3.0, <= 26.4.7 | No fix yet |
| GHSA-8g9r-9wjw-37j4 Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API |
Medium EPSS 0.26% |
<= 26.5.6 | No fix yet |
| GHSA-xh32-c9wx-phrp Keycloak: Information disclosure of disabled user attributes via administrative endpoint |
Low EPSS 0.35% |
<= 26.5.5 | No fix yet |
| GHSA-m297-3jv9-m927 Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator |
High EPSS 0.38% |
< 26.5.5 | 26.5.5 |
| GHSA-7g5x-9c4v-4w5r Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass |
Low EPSS 0.23% |
< 26.4.4 | 26.4.4 |
| GHSA-fjf4-6f34-w64q Keycloak: Missing Check on Disabled Client for Docker Registry Protocol |
Low EPSS 0.37% |
<= 26.5.3 | No fix yet |
| GHSA-hcvw-475w-8g7p Keycloak affected by improper invitation token validation |
High EPSS 0.49% |
>= 26.5.0, < 26.5.3 | 26.5.3 |
| GHSA-hcvw-475w-8g7p Keycloak affected by improper invitation token validation |
High EPSS 0.49% |
< 26.2.13 | 26.2.13 |
| GHSA-hcvw-475w-8g7p Keycloak affected by improper invitation token validation |
High EPSS 0.49% |
>= 26.3.0, < 26.4.9 | 26.4.9 |
| GHSA-37gf-gmxv-74wv Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens |
High EPSS 0.50% |
< 26.4.9 | 26.4.9 |
| GHSA-37gf-gmxv-74wv Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens |
High EPSS 0.50% |
>= 26.5.0, < 26.5.3 | 26.5.3 |
| GHSA-fm6w-rrp3-2x4w Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService |
Medium EPSS 0.32% |
< 26.2.13 | 26.2.13 |
| GHSA-fm6w-rrp3-2x4w Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService |
Medium EPSS 0.32% |
>= 26.5.0, < 26.5.3 | 26.5.3 |
| GHSA-fm6w-rrp3-2x4w Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService |
Medium EPSS 0.32% |
>= 26.3.0, < 26.4.9 | 26.4.9 |
| GHSA-g78x-7vwx-9f58 Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes |
Low EPSS 0.41% |
>= 26.5.0, < 26.5.2 | 26.5.2 |
| GHSA-g78x-7vwx-9f58 Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes |
Low EPSS 0.41% |
< 26.4.9 | 26.4.9 |
| GHSA-63v5-26vq-m4vm Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods |
Low EPSS 0.41% |
<= 26.5.2 | No fix yet |
| GHSA-594w-2fwp-jwrc Keycloak Admin REST API exposes backend schema and rules |
Low EPSS 0.35% |
<= 26.2.5 | No fix yet |
| GHSA-wv3h-x6c4-r867 Keycloak services allows the issuance of access and refresh tokens for disabled users |
Medium EPSS 0.49% |
>= 26.5.0, < 26.5.2 | 26.5.2 |
| GHSA-wv3h-x6c4-r867 Keycloak services allows the issuance of access and refresh tokens for disabled users |
Medium EPSS 0.49% |
< 26.4.9 | 26.4.9 |
| GHSA-m2w5-7xhv-w6fh Keycloak does not validate and update refresh token usage atomically |
Low EPSS 0.30% |
<= 26.2.5 | No fix yet |
| GHSA-6q37-7866-h27j Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions |
Low EPSS 0.35% |
< 26.5.0 | 26.5.0 |
| GHSA-rg35-5v25-mqvp Keycloak vulnerable to session takeovers due to reuse of session identifiers |
Medium EPSS 0.14% |
< 26.0.0 | 26.0.0 |
| GHSA-895x-rfqp-jh5c Keycloak does not invalidate offline sessions when the offline_access scope is removed |
Medium EPSS 0.30% |
< 26.2.3 | 26.2.3 |
| GHSA-64w3-5q9m-68xf Keycloak does not invalidate sessions when "Remember Me" is disabled |
Medium EPSS 0.24% |
>= 26.3.0, < 26.4.1 | 26.4.1 |
| GHSA-64w3-5q9m-68xf Keycloak does not invalidate sessions when "Remember Me" is disabled |
Medium EPSS 0.24% |
< 26.2.11 | 26.2.11 |
| GHSA-qj5r-2r5p-phc7 Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability Withdrawn |
Medium | <= 26.3.2 | No fix yet |
| GHSA-m4j5-5x4r-2xp9 Keycloak SMTP Inject Vulnerability |
Medium EPSS 0.57% |
< 26.2.8 | 26.2.8 |
| GHSA-m4j5-5x4r-2xp9 Keycloak SMTP Inject Vulnerability |
Medium EPSS 0.57% |
>= 26.3.0, < 26.3.3 | 26.3.3 |
| GHSA-83j7-mhw9-388w Duplicate Advisory: Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled) Withdrawn |
Medium | <= 26.3.1 | No fix yet |
| GHSA-27gp-8389-hm4w Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled) |
Medium EPSS 0.45% |
>= 26.2.0, < 26.2.6 | 26.2.6 |
| GHSA-gj52-35xm-gxjh Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow Withdrawn |
Medium | < 26.3.0 | 26.3.0 |
| GHSA-xhpr-465j-7p9q Keycloak phishing attack via email verification step in first login flow |
High EPSS 0.27% |
< 26.0.13 | 26.0.13 |
| GHSA-xhpr-465j-7p9q Keycloak phishing attack via email verification step in first login flow |
High EPSS 0.27% |
>= 26.2.0, < 26.2.6 | 26.2.6 |
| GHSA-r934-w73g-v4p8 Duplicate Advisory: Keycloak hostname verification Withdrawn |
High | < 26.2.2 | 26.2.2 |
| GHSA-fx44-2wx5-5fvp Duplicate Advisory: Keycloak vulnerable to two factor authentication bypass Withdrawn |
Medium | < 26.2.2 | 26.2.2 |
| GHSA-5jfq-x6xp-7rw2 Keycloak vulnerable to two factor authentication bypass |
Medium EPSS 0.45% |
< 26.2.2 | 26.2.2 |
| GHSA-hw58-3793-42gg Keycloak hostname verification |
High EPSS 0.47% |
< 26.2.2 | 26.2.2 |
| GHSA-2935-2wfm-hhpv Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache |
Medium EPSS 0.70% |
<= 26.1.4 | No fix yet |
| GHSA-rq4w-cjrr-h8w8 Duplicate Advisory: Keycloak allows Incorrect Assignment of an Organization to a User Withdrawn |
Medium | < 26.1.2 | 26.1.2 |
| GHSA-gvgg-2r3r-53x7 Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims |
Medium EPSS 0.47% |
>= 26.1.0, < 26.1.3 | 26.1.3 |
| GHSA-gvgg-2r3r-53x7 Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims |
Medium EPSS 0.47% |
< 26.0.10 | 26.0.10 |
| GHSA-j3x3-r585-4qhg Duplicate Advisory: org.keycloak:keycloak-services has Inefficient Regular Expression Complexity Withdrawn |
Medium | >= 25.0.0, < 26.0.6 | 26.0.6 |
| GHSA-j3x3-r585-4qhg Duplicate Advisory: org.keycloak:keycloak-services has Inefficient Regular Expression Complexity Withdrawn |
Medium | < 24.0.9 | 24.0.9 |
| GHSA-wq8x-cg39-8mrr org.keycloak:keycloak-services has Inefficient Regular Expression Complexity |
Medium EPSS 1.24% |
< 24.0.9 | 24.0.9 |
| GHSA-wq8x-cg39-8mrr org.keycloak:keycloak-services has Inefficient Regular Expression Complexity |
Medium EPSS 1.24% |
>= 25.0.0, < 26.0.6 | 26.0.6 |
| GHSA-vvf8-2h68-9475 Duplicate Advisory: Keycloak Open Redirect vulnerability Withdrawn |
Medium | < 25.0.6 | 25.0.6 |
| GHSA-w8gr-xwp4-r9f7 Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect |
Medium EPSS 2.11% |
>= 25.0.0, < 25.0.6 | 25.0.6 |
| GHSA-w8gr-xwp4-r9f7 Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect |
Medium EPSS 2.11% |
>= 23.0.0, < 24.0.8 | 24.0.8 |
| GHSA-w8gr-xwp4-r9f7 Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect |
Medium EPSS 2.11% |
< 22.0.13 | 22.0.13 |
| GHSA-5rxp-2rhr-qwqv Keycloak has session fixation in Elytron SAML adapters |
High EPSS 0.85% |
>= 23.0.0, < 24.0.7 | 24.0.7 |
| GHSA-5rxp-2rhr-qwqv Keycloak has session fixation in Elytron SAML adapters |
High EPSS 0.85% |
>= 23.0.0, < 24.0.7 | 24.0.7 |
| GHSA-5rxp-2rhr-qwqv Keycloak has session fixation in Elytron SAML adapters |
High EPSS 0.85% |
< 22.0.12 | 22.0.12 |
| GHSA-5rxp-2rhr-qwqv Keycloak has session fixation in Elytron SAML adapters |
High EPSS 0.85% |
>= 25.0.0, < 25.0.5 | 25.0.5 |
| GHSA-5rxp-2rhr-qwqv Keycloak has session fixation in Elytron SAML adapters |
High EPSS 0.85% |
< 22.0.12 | 22.0.12 |
| GHSA-5rxp-2rhr-qwqv Keycloak has session fixation in Elytron SAML adapters |
High EPSS 0.85% |
>= 25.0.0, < 25.0.5 | 25.0.5 |
| GHSA-8wm9-24qg-m5qj Duplicate Advisory: Keycloak has a brute force login protection bypass Withdrawn |
Medium | < 24.0.4 | 24.0.4 |
| GHSA-gc7q-jgjv-vjr2 Keycloak Services has a potential bypass of brute force protection |
Medium EPSS 0.79% |
>= 23.0.0, < 24.0.7 | 24.0.7 |
| GHSA-gc7q-jgjv-vjr2 Keycloak Services has a potential bypass of brute force protection |
Medium EPSS 0.79% |
< 22.0.12 | 22.0.12 |
| GHSA-gc7q-jgjv-vjr2 Keycloak Services has a potential bypass of brute force protection |
Medium EPSS 0.79% |
>= 25.0.0, < 25.0.4 | 25.0.4 |
| GHSA-4vc8-pg5c-vg4x Keycloak's improper input validation allows using email as username |
Low EPSS 2.19% |
< 24.0.1 | 24.0.1 |
| GHSA-2cww-fgmg-4jqc Keycloak's admin API allows low privilege users to use administrative functions |
High EPSS 3.32% |
< 24.0.5 | 24.0.5 |
| GHSA-4vrx-8phj-x3mg Duplicate Advisory: Keycloak exposes sensitive information in Pushed Authorization Requests (PAR) Withdrawn |
High | < 24.0.5 | 24.0.5 |
| GHSA-69fp-7c8p-crjr Keycloak exposes sensitive information in Pushed Authorization Requests (PAR) |
High EPSS 0.55% |
< 24.0.5 | 24.0.5 |
| GHSA-7fpj-9hr8-28vh Keycloak vulnerable to impersonation via logout token exchange |
Low EPSS 0.30% |
< 22.0.10 | 22.0.10 |
| GHSA-7fpj-9hr8-28vh Keycloak vulnerable to impersonation via logout token exchange |
Low EPSS 0.30% |
>= 23.0.0, < 24.0.3 | 24.0.3 |
| GHSA-c9h6-v78w-52wj Keycloak vulnerable to session hijacking via re-authentication |
High EPSS 0.74% |
>= 23.0.0, < 24.0.3 | 24.0.3 |
| GHSA-c9h6-v78w-52wj Keycloak vulnerable to session hijacking via re-authentication |
High EPSS 0.74% |
< 22.0.10 | 22.0.10 |
| GHSA-j628-q885-8gr5 Keycloak vulnerable to log Injection during WebAuthn authentication or registration |
Medium EPSS 1.01% |
>= 23.0.0, < 23.0.5 | 23.0.5 |
| GHSA-j628-q885-8gr5 Keycloak vulnerable to log Injection during WebAuthn authentication or registration |
Medium EPSS 1.01% |
< 22.0.9 | 22.0.9 |
| GHSA-46c8-635v-68r2 Keycloak Authorization Bypass vulnerability |
Medium EPSS 1.07% |
>= 23.0.0, < 24.0.3 | 24.0.3 |
| GHSA-46c8-635v-68r2 Keycloak Authorization Bypass vulnerability |
Medium EPSS 1.07% |
< 22.0.10 | 22.0.10 |
| GHSA-8rmm-gm28-pj8q Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow |
Medium EPSS 0.71% |
>= 23.0.0, < 24.0.3 | 24.0.3 |
| GHSA-8rmm-gm28-pj8q Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow |
Medium EPSS 0.71% |
< 22.0.10 | 22.0.10 |
| GHSA-4f53-xh3v-g8x4 Keycloak secondary factor bypass in step-up authentication |
Medium EPSS 0.60% |
>= 23.0.0, < 24.0.3 | 24.0.3 |
| GHSA-4f53-xh3v-g8x4 Keycloak secondary factor bypass in step-up authentication |
Medium EPSS 0.60% |
< 22.0.10 | 22.0.10 |
| GHSA-mrv8-pqfj-7gp5 Keycloak path traversal vulnerability in the redirect validation |
High EPSS 0.50% |
< 22.0.10 | 22.0.10 |
| GHSA-mrv8-pqfj-7gp5 Keycloak path traversal vulnerability in the redirect validation |
High EPSS 0.50% |
>= 23.0.0, < 24.0.3 | 24.0.3 |
| GHSA-m6q9-p373-g5q8 Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS |
High EPSS 0.45% |
< 22.0.10 | 22.0.10 |
| GHSA-m6q9-p373-g5q8 Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS |
High EPSS 0.45% |
>= 23.0.0, < 24.0.3 | 24.0.3 |
| GHSA-72vp-xfrc-42xm Keycloak path traversal vulnerability in redirection validation |
High EPSS 1.55% |
< 22.0.10 | 22.0.10 |
| GHSA-72vp-xfrc-42xm Keycloak path traversal vulnerability in redirection validation |
High EPSS 1.55% |
>= 23.0.0, < 24.0.3 | 24.0.3 |
| GHSA-cq42-vhv7-xr7p Keycloak Denial of Service via account lockout |
Medium EPSS 0.77% |
< 24.0.0 | 24.0.0 |
| GHSA-mpwq-j3xf-7m5w The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted |
High EPSS 0.95% |
< 23.0.3 | 23.0.3 |
| GHSA-5968-qw33-h47j Duplicate Advisory: Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri Withdrawn |
Medium | < 23.0.3 | 23.0.3 |
| GHSA-cvg2-7c3j-g36j Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri |
Medium EPSS 1.32% |
< 23.0.3 | 23.0.3 |
| GHSA-8hc5-rmgf-qx6p Keycloak vulnerable to LDAP Injection on UsernameForm Login |
High EPSS 0.65% |
< 23.0.1 | 23.0.1 |
| GHSA-3qh5-qqj2-c78f Keycloak vulnerable to Improper Client Certificate Validation for OAuth/OpenID clients |
High EPSS 0.52% |
< 21.1.2 | 21.1.2 |
| GHSA-3p62-6fjh-3p5h Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC |
Medium EPSS 0.69% |
< 21.1.2 | 21.1.2 |
| GHSA-f5h4-wmp5-xhg6 Client Spoofing within the Keycloak Device Authorisation Grant |
High EPSS 0.69% |
< 21.1.2 | 21.1.2 |
| GHSA-9g98-5mj6-f9mv Keycloak vulnerable to user impersonation via stolen UUID code |
Medium EPSS 1.27% |
< 21.0.1 | 21.0.1 |
| GHSA-m4fv-gm5m-4725 HTML Injection in Keycloak Admin REST API |
Medium EPSS 0.70% |
< 20.0.5 | 20.0.5 |
| GHSA-w354-2f3c-qvg9 Keycloak vulnerable to Cross-site Scripting |
Medium EPSS 0.66% |
<= 21.0.0 | No fix yet |
| GHSA-5r7w-pjx8-99qg JBoss KeyCloak Open Redirect |
Medium EPSS 0.66% |
< 1.1.0.Beta1 | 1.1.0.Beta1 |
| GHSA-237q-6hjp-pchq JBoss KeyCloak is vulnerable to soft token deletion via CSRF |
Medium EPSS 0.46% |
< 1.0.2.Final | 1.0.2.Final |
| GHSA-xr6q-qqx7-553g JBoss Keycloak CSRF Vulnerability |
High EPSS 0.82% |
< 1.0.3.Final | 1.0.3.Final |
| GHSA-xvv8-8wh9-9fh2 Keycloak Authentication Error |
Medium EPSS 0.35% |
< 4.4.0.Final | 4.4.0.Final |
| GHSA-mwm4-5qwr-g9pf Keycloak is vulnerable to IDN homograph attack |
Low | < 18.0.0 | 18.0.0 |
| GHSA-pf38-cw3p-22q9 Keycloak is vulnerable to IDN homograph attack |
Medium EPSS 0.77% |
< 18.0.0 | 18.0.0 |
| GHSA-75p6-52g3-rqc8 Keycloak vulnerable to privilege escalation on Token Exchange feature |
Critical EPSS 1.41% |
< 18.0.0 | 18.0.0 |
| GHSA-484q-784p-8m5h Cross-site Scripting in keycloak |
Medium EPSS 0.78% |
< 12.0.0 | 12.0.0 |
| GHSA-83x4-9cwr-5487 Improper Authorization in Keycloak |
High EPSS 1.37% |
< 15.1.1 | 15.1.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor