Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read

Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission

Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes

Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching

Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper

Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability

Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers

Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same…

Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak

Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uri

Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass

Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check

Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter

Keycloak-services: keycloak-services: par single-use bypass via flow restart

Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions

Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement

Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains

Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies

Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

Keycloak-core: dos via account lockout

Keycloak-services: sensitive headers shown in the http access logs

Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints

Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity

Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get

Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email

Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page

Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability

Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor

Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation

Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption