Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

Keycloak: keycloak: privilege escalation due to oversized subject_token jwt

Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login

Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant

Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation

Keycloak: group-admin escalation to realm-admin

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state

Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing

Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

Keycloak: keycloak: denial of service via specially crafted saml input

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

Keycloak: keycloak: privilege escalation via improper scope mapping enforcement

Keycloak: keycloak: information disclosure due to redirect_uri validation bypass

Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data