What’s Vulnerable › Products

Keycloak vulnerabilities

108 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 15 published in the last 12 months.

Check whether your Keycloak version is affected

Latest Keycloak vulnerabilities

• CVE-2026-90997 — Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch (CVSS 7.4)
• CVE-2026-3047 — Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login (CVSS 8.8)
• CVE-2025-12150 — Org.keycloak/keycloak-services: webauthn attestation statement verification bypass (CVSS 3.1)
• CVE-2026-0871 — Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators (CVSS 4.9)
• CVE-2025-13467 — Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation (CVSS 5.5)
• CVE-2025-11538 — Keycloak-server: debug default bind address (CVSS 6.8)
• CVE-2025-12390 — Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id (CVSS 6.0)
• CVE-2025-10939 — Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console (CVSS 3.7)
• CVE-2025-12110 — Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed (CVSS 5.4)
• CVE-2025-11429 — Keycloak-server: too long and not settings compliant session (CVSS 5.4)
• CVE-2025-10044 — Keycloak: keycloak error_description injection on error pages (CVSS 4.3)
• CVE-2025-9162 — Org.keycloak/keycloak-model-storage-service: variable injection into environment variables (CVSS 4.9)
• CVE-2025-8419 — Org.keycloak/keycloak-services: keycloak smtp inject vulnerability (CVSS 5.3)
• CVE-2025-7365 — Keycloak: phishing attack via email verification step in first login flow (CVSS 7.1)
• CVE-2025-5416 — Keycloak-core: keycloak environment information (CVSS 2.7)
• CVE-2023-6841 — Keycloak: amount of attributes per object is not limited and it may lead to dos (CVSS 7.5)
• CVE-2024-7341 — Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters (CVSS 7.1)
• CVE-2024-7260 — Keycloak-core: open redirect on account page (CVSS 6.1)
• CVE-2024-4629 — Keycloak: potential bypass of brute force protection (CVSS 6.5)
• CVE-2023-6787 — Keycloak: session hijacking via re-authentication (CVSS 8.8)
• CVE-2023-6717 — Keycloak: xss via assertion consumer service url in saml post-binding flow (CVSS 6.0)
• CVE-2024-1132 — Keycloak: path transversal in redirection validation (CVSS 8.1)
• CVE-2024-1722 — Keycloak-core: dos via account lockout (CVSS 5.3)
• CVE-2023-6291 — Keycloak: redirect_uri validation bypass (CVSS 7.1)
• CVE-2023-6927 — Keycloak: open redirect via "form_post.jwt" jarm response mode (CVSS 6.1)