It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF)…

Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR…

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session

Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

Keycloak-server: debug default bind address

Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id

Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation

Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed

Keycloak-server: too long and not settings compliant session

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations

Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

Org.keycloak/keycloak-model-storage-service: variable injection into environment variables

Keycloak: keycloak error_description injection on error pages

Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console

Org.keycloak/keycloak-services: webauthn attestation statement verification bypass