Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation

Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

Keycloak: keycloak: privilege escalation due to oversized subject_token jwt

Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction

Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant

Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

Keycloak: group-admin escalation to realm-admin

Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state

Resteasy-core: resteasy sourceprovider remote unauthenticated file read

Micrometer HTTP server instrumentations DoS vulnerability

Micrometer gRPC server instrumentation DoS vulnerability

Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing

Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client

Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

Keycloak: keycloak: privilege escalation via improper scope mapping enforcement

Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation

Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart

Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

Keycloak-services: keycloak-services: client access-type policy condition bypass during client update

Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes

Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2

Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token

Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability

Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition

Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired

Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed

Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled

Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

Keycloak: keycloak: denial of service via malformed authorization header

Keycloak: keycloak: information disclosure via saml ecp endpoint

Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim