Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get

Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables

Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email

Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page

Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability

Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor

Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation

Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization

Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption

Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control

Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins

Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering

Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator

Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path

Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients