VendorsRed Hatbuild_of_keycloakany version

Vulnerabilities

Red Hat Build any version

Ranked by severity, then by exploit likelihood. Click a CVE ID for its full record.

110CVEs

CVE-2026-16072

Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

Published 2026-07-17 · Modified

4.9EPSS 0.004

CVE-2026-16106

Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

Published 2026-07-17 · Modified

4.9EPSS 0.004

CVE-2026-16105

Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

Published 2026-07-31 · Modified

4.9EPSS 0.004

CVE-2026-14613

Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

Published 2026-07-03 · Modified

4.9EPSS 0.004

CVE-2026-0871

Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

Published 2026-02-27 · Analyzed

4.9EPSS 0.003

CVE-2026-11986

Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak

Published 2026-06-11 · Analyzed

4.9EPSS 0.003

CVE-2024-7318

Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity

Published 2024-09-09 · Analyzed

4.8EPSS 0.004

CVE-2026-14781

Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email

Published 2026-07-05 · Analyzed

4.8EPSS 0.003

CVE-2026-18209

Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

Published 2026-07-31 · Modified

4.7EPSS 0.004

CVE-2026-18217

Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

Published 2026-07-31 · Analyzed

4.7EPSS 0.003

CVE-2026-9799

Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass

Published 2026-06-25 · Analyzed

4.6EPSS 0.003

CVE-2026-9798

Keycloak: keycloak: brute-force protection bypass in ciba flow

Published 2026-05-28 · Modified

4.3EPSS 0.005

CVE-2026-8830

Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation

Published 2026-05-19 · Modified

4.3EPSS 0.004

CVE-2026-37981

Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint

Published 2026-05-19 · Analyzed

4.3EPSS 0.004

CVE-2026-14209

Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions

Published 2026-06-30 · Modified

4.3EPSS 0.004

CVE-2026-14615

Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter

Published 2026-07-03 · Analyzed

4.3EPSS 0.004

CVE-2026-9791

Keycloak-rhel9: organization data leak after feature disabled in keycloak

Published 2026-05-28 · Modified

4.3EPSS 0.004

CVE-2026-15945

Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2

Published 2026-07-16 · Modified

4.3EPSS 0.003

CVE-2026-16103

Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption

Published 2026-07-17 · Modified

4.3EPSS 0.003

CVE-2026-3190

Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api

Published 2026-03-26 · Modified

4.3EPSS 0.003

CVE-2026-4628

Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control

Published 2026-03-23 · Analyzed

4.3EPSS 0.003

CVE-2026-9689

Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604

Published 2026-05-27 · Modified

4.2EPSS 0.004

CVE-2026-3429

Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api

Published 2026-03-11 · Analyzed

4.2EPSS 0.003

CVE-2026-4633

Keycloak: keycloak: user enumeration via differential error messages

Published 2026-03-23 · Analyzed

3.7EPSS 0.004

CVE-2026-18206

Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass

Published 2026-07-31 · Analyzed

3.7EPSS 0.003

CVE-2026-18569

Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens

Published 2026-08-04 · Analyzed

3.7EPSS 0.003

CVE-2026-4874

Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation

Published 2026-03-26 · Modified

3.1EPSS 0.003

CVE-2026-2366

Keycloak: keycloak: information disclosure via authorization bypass in admin api

Published 2026-03-12 · Analyzed

3.1EPSS 0.003

CVE-2025-12150

Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

Published 2026-02-27 · Analyzed

3.1EPSS 0.002

CVE-2026-3911

Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint

Published 2026-03-11 · Analyzed

2.7EPSS 0.004

Red Hat Build any version

Security check