Redhat Build Of Keycloak — known CVE vulnerabilities

Every CVE whose affected-product data names Redhat Build Of Keycloak, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (111)

• CVE-2026-15572 — CVSS 8.8 (high): A flaw was found in Keycloak's Dynamic Client Registration (DCR) security policy management. The "Allowed Protocol Mapper Types" policy…
• CVE-2026-3047 — CVSS 8.8 (high): A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity…
• CVE-2026-7504 — CVSS 8.1 (high): A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass…
• CVE-2026-16102 — CVSS 8.1 (high): A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default…
• CVE-2026-9800 — CVSS 8.1 (high): A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies…
• CVE-2026-3009 — CVSS 8.1 (high): A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider…
• CVE-2026-1609 — CVSS 8.1 (high): A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled…
• CVE-2026-2603 — CVSS 8.1 (high): A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity…
• CVE-2026-4636 — CVSS 8.1 (high): A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation…
• CVE-2024-1132 — CVSS 8.1 (high): A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to…
• CVE-2026-11800 — CVSS 8.1 (high): A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid…
• CVE-2026-15573 — CVSS 8.1 (high): A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies…
• CVE-2026-9099 — CVSS 7.7 (high): A flaw was found in Keycloak. A missing authorization check in the GroupResource.addChild() endpoint within the Admin REST API allows an…
• CVE-2026-2092 — CVSS 7.7 (high): A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted…
• CVE-2026-7307 — CVSS 7.5 (high): A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup…
• CVE-2024-7885 — CVSS 7.5 (high): A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests…
• CVE-2026-7507 — CVSS 7.5 (high): A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by…
• CVE-2026-4634 — CVSS 7.5 (high): A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with…
• CVE-2026-16443 — CVSS 7.4 (high): A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity…
• CVE-2026-16442 — CVSS 7.4 (high): A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue…
• CVE-2026-4282 — CVSS 7.4 (high): A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This…
• CVE-2026-9086 — CVSS 7.3 (high): A flaw was found in Keycloak. A remote attacker with administrative privileges, specifically those with `manage-client` permission or…
• CVE-2026-9795 — CVSS 7.3 (high): A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature. An administrator with limited client management permissions…
• CVE-2026-3872 — CVSS 7.3 (high): A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path…
• CVE-2026-7571 — CVSS 7.1 (high): A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control…
• CVE-2024-7341 — CVSS 7.1 (high): A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at…
• CVE-2026-37980 — CVSS 6.9 (medium): A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or…
• CVE-2026-9802 — CVSS 6.8 (medium): A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset…
• CVE-2026-18215 — CVSS 6.8 (medium): Keycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw…
• CVE-2026-4630 — CVSS 6.8 (medium): A flaw was found in Keycloak. An authenticated client could exploit an Insecure Direct Object Reference (IDOR) vulnerability in the…
• CVE-2026-37982 — CVSS 6.8 (medium): A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens…
• CVE-2026-9704 — CVSS 6.8 (medium): A flaw was found in Keycloak. An authenticated user with low privileges can exploit this vulnerability by sending an oversized…
• CVE-2026-18214 — CVSS 6.8 (medium): Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A…
• CVE-2026-18571 — CVSS 6.6 (medium): A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows…
• CVE-2023-6787 — CVSS 6.5 (medium): A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication. This flaw…
• CVE-2024-4629 — CVSS 6.5 (medium): A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login…
• CVE-2025-7784 — CVSS 6.5 (medium): A flaw was found in the Keycloak identity and access management system when Fine-Grained Admin Permissions(FGAPv2) are enabled. An…
• CVE-2026-12388 — CVSS 6.5 (medium): A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external…
• CVE-2026-16100 — CVSS 6.5 (medium): A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from…
• CVE-2026-17059 — CVSS 6.5 (medium): A flaw was found in the role-users endpoint of the keycloak-services library, which is the core component of the Keycloak identity and…
• CVE-2026-18203 — CVSS 6.5 (medium): A flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set…
• CVE-2026-18207 — CVSS 6.5 (medium): A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name…
• CVE-2026-18208 — CVSS 6.5 (medium): A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and…
• CVE-2026-18572 — CVSS 6.5 (medium): Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example…
• CVE-2026-18573 — CVSS 6.5 (medium): A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The…
• CVE-2026-3121 — CVSS 6.5 (medium): A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is…
• CVE-2026-37979 — CVSS 6.5 (medium): A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a…
• CVE-2026-4629 — CVSS 6.5 (medium): A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a…
• CVE-2026-9705 — CVSS 6.5 (medium): A flaw was found in Keycloak's client registration service. A remote attacker, possessing a previously issued Registration Access Token…
• CVE-2026-9792 — CVSS 6.5 (medium): A flaw was found in Keycloak's Client Policies, specifically within the `org.keycloak.protocol.oidc` component. When certain condition…
• CVE-2026-9796 — CVSS 6.5 (medium): A flaw was found in Keycloak. An authenticated administrator with the `manage-clients` role can exploit a Time-of-check to time-of-use…
• CVE-2026-9087 — CVSS 6.4 (medium): A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the…
• CVE-2026-18967 — CVSS 6.4 (medium): A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker…
• CVE-2024-10234 — CVSS 6.1 (medium): A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an…
• CVE-2024-7260 — CVSS 6.1 (medium): An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri…
• CVE-2024-8883 — CVSS 6.1 (medium): A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect…
• CVE-2026-9793 — CVSS 5.9 (medium): A flaw was found in Keycloak. When a JSON Web Encryption (JWE) encrypted request object is submitted, Keycloak may incorrectly process…
• CVE-2026-4366 — CVSS 5.8 (medium): A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing…
• CVE-2026-15943 — CVSS 5.5 (medium): A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a…
• CVE-2026-17048 — CVSS 5.5 (medium): A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system…
• CVE-2026-18201 — CVSS 5.5 (medium): Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an…
• CVE-2026-16071 — CVSS 5.4 (medium): A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue…
• CVE-2026-16093 — CVSS 5.4 (medium): Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs…
• CVE-2026-16089 — CVSS 5.4 (medium): A flaw was found in the keycloak-services component of Red Hat Build of Keycloak. The issue occurs because OAuth 2.0 authorization codes…
• CVE-2025-3910 — CVSS 5.4 (medium): A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to…
• CVE-2026-8922 — CVSS 5.4 (medium): A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID…
• CVE-2026-18570 — CVSS 5.4 (medium): A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible…
• CVE-2026-7500 — CVSS 5.4 (medium): When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints…
• CVE-2026-14614 — CVSS 5.4 (medium): A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled…
• CVE-2026-4325 — CVSS 5.3 (medium): A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This…
• CVE-2026-2575 — CVSS 5.3 (medium): A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a…
• CVE-2026-9803 — CVSS 5.3 (medium): A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by…
• CVE-2026-9794 — CVSS 5.3 (medium): A flaw was found in Keycloak. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted SOAP requests…
• CVE-2026-11986 — CVSS 4.9 (medium): A flaw was found in the admin-ui-ext component of Keycloak, which provides extended administrative user interface capabilities. The issue…
• CVE-2026-16106 — CVSS 4.9 (medium): A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated…
• CVE-2026-37978 — CVSS 4.9 (medium): A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes'…
• CVE-2026-16072 — CVSS 4.9 (medium): A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations…
• CVE-2026-16105 — CVSS 4.9 (medium): A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin…
• CVE-2026-0871 — CVSS 4.9 (medium): A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for…
• CVE-2026-9083 — CVSS 4.9 (medium): A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary…
• CVE-2026-9801 — CVSS 4.9 (medium): A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight…
• CVE-2024-7318 — CVSS 4.8 (medium): A vulnerability was found in Keycloak. Expired OTP codes are still usable when using FreeOTP when the OTP token period is set to 30 seconds…
• CVE-2026-14781 — CVSS 4.8 (medium): A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC…
• CVE-2026-9799 — CVSS 4.6 (medium): A flaw was found in org.keycloak.authorization. An authenticated user with a granted User-Managed Access (UMA) permission ticket for one…
• CVE-2026-14613 — CVSS 4.3 (medium): A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups…
• CVE-2026-37981 — CVSS 4.3 (medium): A flaw was found in Keycloak. A broken access control vulnerability in the Account Resources user lookup endpoint allows a remote…
• CVE-2026-16108 — CVSS 4.3 (medium): A flaw was found in the default-groups REST endpoint and realm representation of Keycloak. This component is responsible for managing…
• CVE-2026-4628 — CVSS 4.3 (medium): A flaw was found in Keycloak. An improper Access Control vulnerability in Keycloak’s User-Managed Access (UMA) resource_set endpoint…
• CVE-2026-15945 — CVSS 4.3 (medium): A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP)…
• CVE-2026-14615 — CVSS 4.3 (medium): A flaw was found in the Fine-Grained Admin Permissions (FGAP) v2 implementation within Keycloak's administrative services. When FGAP v2 is…
• CVE-2026-14209 — CVSS 4.3 (medium): A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions…
• CVE-2026-9791 — CVSS 4.3 (medium): A flaw was found in Keycloak. An authenticated user with existing organization membership can exploit this flaw by accessing user-facing…
• CVE-2026-8830 — CVSS 4.3 (medium): A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating…
• CVE-2026-3190 — CVSS 4.3 (medium): A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the…
• CVE-2026-9798 — CVSS 4.3 (medium): A flaw was found in Keycloak, an open-source identity and access management solution. When a user account is temporarily locked due to…
• CVE-2026-16103 — CVSS 4.3 (medium): A flaw was found in the keycloak-services component of Keycloak. This issue is an incomplete fix for CVE-2026-9798, where brute-force…
• CVE-2026-16104 — CVSS 4.3 (medium): A flaw was found in the authentication configuration endpoint of the keycloak-services component, which is the core engine for Red Hat…
• CVE-2026-18211 — CVSS 4.2 (medium): A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for…
• CVE-2026-18218 — CVSS 4.2 (medium): A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens…
• CVE-2026-3429 — CVSS 4.2 (medium): A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive…
• CVE-2026-9689 — CVSS 4.2 (medium): A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept…
• CVE-2026-18206 — CVSS 3.7 (low): A flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs…
• CVE-2026-18569 — CVSS 3.7 (low): A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak…
• CVE-2026-37977 — CVSS 3.7 (low): A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in…
• CVE-2026-4633 — CVSS 3.7 (low): A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when…
• CVE-2026-18209 — CVSS 3.4 (low): A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs…
• CVE-2026-18217 — CVSS 3.4 (low): A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs…
• CVE-2025-12150 — CVSS 3.1 (low): A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured…
• CVE-2026-4874 — CVSS 3.1 (low): A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the…
• CVE-2026-2366 — CVSS 3.1 (low): A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those…
• CVE-2026-3911 — CVSS 2.7 (low): A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component…