Redhat Build Of Keycloak — known CVE vulnerabilities

Every CVE whose affected-product data names Redhat Build Of Keycloak, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (65)

• CVE-2026-3047 — CVSS 8.8 (high): A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity…
• CVE-2026-9800 — CVSS 8.1 (high): A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies…
• CVE-2024-1132 — CVSS 8.1 (high): A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to…
• CVE-2026-4636 — CVSS 8.1 (high): A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation…
• CVE-2026-11800 — CVSS 8.1 (high): A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid…
• CVE-2026-7504 — CVSS 8.1 (high): A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass…
• CVE-2026-3009 — CVSS 8.1 (high): A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider…
• CVE-2026-9099 — CVSS 7.7 (high): A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an…
• CVE-2026-7307 — CVSS 7.5 (high): A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup…
• CVE-2024-7885 — CVSS 7.5 (high): A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests…
• CVE-2026-7507 — CVSS 7.5 (high): A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by…
• CVE-2026-4634 — CVSS 7.5 (high): A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with…
• CVE-2026-4282 — CVSS 7.4 (high): A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This…
• CVE-2026-3872 — CVSS 7.3 (high): A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path…
• CVE-2026-9795 — CVSS 7.3 (high): A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions…
• CVE-2026-9086 — CVSS 7.3 (high): A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or…
• CVE-2024-7341 — CVSS 7.1 (high): A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at…
• CVE-2026-7571 — CVSS 7.1 (high): A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control…
• CVE-2026-37980 — CVSS 6.9 (medium): A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or…
• CVE-2026-9802 — CVSS 6.8 (medium): A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset…
• CVE-2026-4630 — CVSS 6.8 (medium): A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the…
• CVE-2026-9704 — CVSS 6.8 (medium): A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized…
• CVE-2026-37982 — CVSS 6.8 (medium): A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens…
• CVE-2026-9796 — CVSS 6.5 (medium): A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use…
• CVE-2026-12388 — CVSS 6.5 (medium): A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external…
• CVE-2026-3121 — CVSS 6.5 (medium): A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is…
• CVE-2026-9792 — CVSS 6.5 (medium): A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition…
• CVE-2026-9705 — CVSS 6.5 (medium): A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token…
• CVE-2026-37979 — CVSS 6.5 (medium): A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a…
• CVE-2026-4629 — CVSS 6.5 (medium): A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a…
• CVE-2024-4629 — CVSS 6.5 (medium): A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login…
• CVE-2023-6787 — CVSS 6.5 (medium): A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw…
• CVE-2025-7784 — CVSS 6.5 (medium): A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An…
• CVE-2026-9087 — CVSS 6.4 (medium): A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the…
• CVE-2024-10234 — CVSS 6.1 (medium): A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an…
• CVE-2024-8883 — CVSS 6.1 (medium): A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect…
• CVE-2024-7260 — CVSS 6.1 (medium): An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri…
• CVE-2026-9793 — CVSS 5.9 (medium): A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process…
• CVE-2026-4366 — CVSS 5.8 (medium): A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing…
• CVE-2026-7500 — CVSS 5.4 (medium): When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints…
• CVE-2025-3910 — CVSS 5.4 (medium): A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to…
• CVE-2026-8922 — CVSS 5.4 (medium): A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID…
• CVE-2026-9803 — CVSS 5.3 (medium): A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by…
• CVE-2026-4325 — CVSS 5.3 (medium): A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This…
• CVE-2026-2575 — CVSS 5.3 (medium): A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a…
• CVE-2026-9794 — CVSS 5.3 (medium): A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests…
• CVE-2026-9083 — CVSS 4.9 (medium): A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary…
• CVE-2026-9801 — CVSS 4.9 (medium): A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight…
• CVE-2026-0871 — CVSS 4.9 (medium): A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for…
• CVE-2026-37978 — CVSS 4.9 (medium): A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes'…
• CVE-2024-7318 — CVSS 4.8 (medium): A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds…
• CVE-2026-9799 — CVSS 4.6 (medium): A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one…
• CVE-2026-9798 — CVSS 4.3 (medium): A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to…
• CVE-2026-9791 — CVSS 4.3 (medium): A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing…
• CVE-2026-3190 — CVSS 4.3 (medium): A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the…
• CVE-2026-4628 — CVSS 4.3 (medium): A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint…
• CVE-2026-37981 — CVSS 4.3 (medium): A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote…
• CVE-2026-14209 — CVSS 4.3 (medium): A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions…
• CVE-2026-8830 — CVSS 4.3 (medium): A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating…
• CVE-2026-9689 — CVSS 4.2 (medium): A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept…
• CVE-2026-4633 — CVSS 3.7 (low): A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when…
• CVE-2026-37977 — CVSS 3.7 (low): A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in…
• CVE-2025-12150 — CVSS 3.1 (low): A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured…
• CVE-2026-4874 — CVSS 3.1 (low): A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the…
• CVE-2026-3911 — CVSS 2.7 (low): A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component…