Keycloak (Redhat) - vulnerabilities (CVEs)

98 CVEs, 0 in the last 30 days, 201 known versions, newest CVE from 2026-03-05. Vendor: Redhat.

CVEs of Keycloak

CVE-2026-3047 - CVSS 8.8 (high), 2026-03-05: A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider…
CVE-2025-12150 - CVSS 3.1 (low), 2026-02-27: A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register…
CVE-2026-0871 - CVSS 4.9 (medium), 2026-02-27: A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes,…
CVE-2025-8419 - CVSS 5.3 (medium), 2025-08-06: A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short…
CVE-2025-7365 - CVSS 7.1 (high), 2025-07-10: A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login,…
CVE-2025-5416 - CVSS 2.7 (low), 2025-06-20: A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the…
CVE-2023-6841 - CVSS 7.5 (high), 2024-09-10: A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests…
CVE-2024-7260 - CVSS 6.1 (medium), 2024-09-09: An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to…
CVE-2024-7341 - CVSS 7.1 (high), 2024-09-09: A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even…
CVE-2024-4629 - CVSS 6.5 (medium), 2024-09-03: A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating…
CVE-2023-6787 - CVSS 8.8 (high), 2024-04-25: A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw allows hijacking an…
CVE-2024-1132 - CVSS 8.1 (high), 2024-04-17: A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious…
CVE-2024-1722 - CVSS 5.3 (medium), 2024-02-29: A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in.
CVE-2023-6291 - CVSS 7.1 (high), 2024-01-26: A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack…
CVE-2023-6927 - CVSS 6.1 (medium), 2023-12-18: A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode…
CVE-2023-48795 - CVSS 5.9 (medium), 2023-12-18: The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks…
CVE-2023-6134 - CVSS 5.4 (medium), 2023-12-14: A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an…
CVE-2023-6563 - CVSS 7.7 (high), 2023-12-14: An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (>…
CVE-2023-2422 - CVSS 7.1 (high), 2023-10-04: A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client…
CVE-2022-4137 - CVSS 8.1 (high), 2023-09-25: A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious…
CVE-2022-3916 - CVSS 6.8 (medium), 2023-09-20: A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due…
CVE-2022-1438 - CVSS 6.4 (medium), 2023-09-20: A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting…
CVE-2023-4918 - CVSS 8.8 (high), 2023-09-12: A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password"…
CVE-2023-0264 - CVSS 5 (medium), 2023-08-04: A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain…
CVE-2022-4361 - CVSS 10 (critical), 2023-07-07: Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The…
CVE-2023-1664 - CVSS 6.5 (medium), 2023-05-26: A flaw was found in Keycloak. This flaw depends on a non-default configuration "Revalidate Client Certificate" to be enabled and the reverse proxy is not…
CVE-2022-1274 - CVSS 5.4 (medium), 2023-03-29: A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can…
CVE-2023-0105 - CVSS 6.5 (medium), 2023-01-13: A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can…
CVE-2023-0091 - CVSS 3.8 (low), 2023-01-13: A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an…
CVE-2022-3782 - CVSS 9.1 (critical), 2023-01-13: keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker…
CVE-2022-0225 - CVSS 5.4 (medium), 2022-08-26: A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin…
CVE-2021-3856 - CVSS 4.3 (medium), 2022-08-26: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme…
CVE-2021-3754 - CVSS 5.3 (medium), 2022-08-26: A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble…
CVE-2021-3632 - CVSS 7.5 (high), 2022-08-26: A flaw was found in Keycloak. This vulnerability allows anyone to register a new security device or key when there is not a device already registered for any…
CVE-2021-3827 - CVSS 6.8 (medium), 2022-08-23: A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker…
CVE-2020-35509 - CVSS 5.4 (medium), 2022-08-23: A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. An expired certificate would be accepted by the direct-grant authenticator because of…
CVE-2021-3513 - CVSS 7.5 (high), 2022-08-22: A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message…
CVE-2022-2668 - CVSS 7.2 (high), 2022-08-05: An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled
CVE-2022-1245 - CVSS 9.8 (critical), 2022-07-08: A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access…
CVE-2022-1466 - CVSS 6.5 (medium), 2022-04-26: Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. It was possible to…
CVE-2021-3461 - CVSS 7.1 (high), 2022-04-01: A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal…
CVE-2021-20323 - CVSS 6.1 (medium), 2022-03-25: A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
CVE-2021-4133 - CVSS 8.8 (high), 2022-01-25: A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user…
CVE-2021-3637 - CVSS 7.5 (high), 2021-07-09: A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows…
CVE-2021-20195 - CVSS 9.6 (critical), 2021-05-28: A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to…
CVE-2020-27826 - CVSS 4.2 (medium), 2021-05-28: A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an…
CVE-2021-20202 - CVSS 7.3 (high), 2021-05-12: A flaw was found in keycloak. Directories can be created prior to the Java process creating them in the temporary directory, but with wider user permissions,…
CVE-2021-20222 - CVSS 7.5 (high), 2021-03-23: A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this…
CVE-2021-20262 - CVSS 6.8 (medium), 2021-03-09: A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account…
CVE-2020-27838 - CVSS 6.5 (medium), 2021-03-08: A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client…
CVE-2020-1717 - CVSS 2.7 (low), 2021-02-11: A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.
CVE-2020-10734 - CVSS 3.3 (low), 2021-02-11: A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat…
CVE-2020-1725 - CVSS 5.4 (medium), 2021-01-28: A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and…
CVE-2020-14302 - CVSS 4.9 (medium), 2020-12-15: A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts…
CVE-2020-10770 - CVSS 5.3 (medium), 2020-12-15: A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This…
CVE-2020-14389 - CVSS 8.1 (high), 2020-11-17: It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing…
CVE-2020-10776 - CVSS 4.8 (medium), 2020-11-17: A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to…
CVE-2020-14366 - CVSS 7.5 (high), 2020-11-09: A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies…
CVE-2020-1694 - CVSS 4.9 (medium), 2020-09-16: A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some…
CVE-2020-10748 - CVSS 6.1 (medium), 2020-09-16: A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an…
CVE-2020-10758 - CVSS 7.5 (high), 2020-09-16: A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server,…
CVE-2020-1727 - CVSS 6.4 (medium), 2020-06-22: A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a…
CVE-2020-1758 - CVSS 5.9 (medium), 2020-05-15: A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server.…
CVE-2020-1714 - CVSS 8.8 (high), 2020-05-13: A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker…
CVE-2020-1718 - CVSS 8.8 (high), 2020-05-12: A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the…
CVE-2020-1724 - CVSS 4.3 (medium), 2020-05-11: A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a…
CVE-2020-1698 - CVSS 5.5 (medium), 2020-05-11: A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat…
CVE-2019-10170 - CVSS 7.2 (high), 2020-05-08: A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker…
CVE-2019-10169 - CVSS 7.2 (high), 2020-05-08: A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated…
CVE-2020-10686 - CVSS 4.7 (medium), 2020-05-04: A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could…
CVE-2020-1728 - CVSS 5.4 (medium), 2020-04-06: A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP…
CVE-2020-1744 - CVSS 5.6 (medium), 2020-03-24: A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login…
CVE-2020-1697 - CVSS 6.1 (medium), 2020-02-10: It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and…
CVE-2019-14820 - CVSS 4.3 (medium), 2020-01-08: It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a…
CVE-2019-14837 - CVSS 9.1 (critical), 2020-01-07: A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a…
CVE-2014-3652 - CVSS 6.1 (medium), 2019-12-15: JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.
CVE-2019-14910 - CVSS 9.8 (critical), 2019-12-05: A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server…
CVE-2019-14909 - CVSS 9.3 (critical), 2019-12-04: A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be…
CVE-2014-3655 - CVSS 4.3 (medium), 2019-11-13: JBoss KeyCloak is vulnerable to soft token deletion via CSRF
CVE-2019-14832 - CVSS 7.5 (high), 2019-10-15: A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated…
CVE-2019-10201 - CVSS 8.1 (high), 2019-08-14: It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and…
CVE-2019-10199 - CVSS 8.8 (high), 2019-08-14: It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick…
CVE-2019-3875 - CVSS 6.5 (medium), 2019-06-12: A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL…
CVE-2019-10157 - CVSS 5.5 (medium), 2019-06-12: It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout .…
CVE-2019-3868 - CVSS 3.8 (low), 2019-04-24: Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an…
CVE-2018-14637 - CVSS 8.1 (high), 2018-11-30: The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this…
CVE-2018-14655 - CVSS 5.4 (medium), 2018-11-13: A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code…
CVE-2018-14658 - CVSS 6.1 (medium), 2018-11-13: A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in…
CVE-2018-14657 - CVSS 8.1 (high), 2018-11-13: A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce…
CVE-2018-10894 - CVSS 5.4 (medium), 2018-08-01: It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access…
CVE-2016-8609 - CVSS 8.1 (high), 2018-08-01: It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from…
CVE-2017-2646 - CVSS 7.5 (high), 2018-07-27: It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method…
CVE-2017-2582 - CVSS 6.5 (medium), 2018-07-26: It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values…
CVE-2018-10912 - CVSS 4.9 (medium), 2018-07-23: keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired…
CVE-2016-8627 - CVSS 6.5 (medium), 2018-05-11: admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET…
CVE-2017-2585 - CVSS 5.9 (medium), 2018-03-12: Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially…
CVE-2016-8629 - CVSS 6.5 (medium), 2018-03-12: Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An…
CVE-2017-12160 - CVSS 7.2 (high), 2017-10-26: It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting…