Login Request a demo
KE
Product
keycloak
by Keycloak · last CVE Sep 17, 2026
17
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Vulnerabilities17In the news0Timeline
Severity mix
Critical 0High 6Medium 9Low 2
Severity
All severities17Critical0High6Medium9Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add keycloak to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2017-12161
8.8
1%
Feb 21
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request
Affected: before 3.4.2
CVE-2014-3709
8.8
1%
Oct 18
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF)…
Affected: through 1.0.2.final
CVE-2026-1609
8.1
1%
Jul 16
Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users
Affected: 26.5.0 before 26.5.3
CVE-2014-3651
7.5
2%
Dec 29
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR…
Affected: before 1.0.3
CVE-2017-12159
7.5
3%
Oct 26
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session
Affected: All versions, or not specified
CVE-2026-90997
7.4
0%
Sep 17
Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch
Affected: 26.7.0 before 26.7.4
Showing 6