Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control

Keycloak-services: keycloak-services: hotp race condition allows single otp code reuse across concurrent logins

Keycloak-services: keycloak-services: required otp enrollment bypassed via update user locale required action ordering

Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator

Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path

Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients

Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol

Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint

Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens

Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass

Keycloak: keycloak: user enumeration via differential error messages

Org.keycloak/keycloak-quarkus-server: keycloak: proxy bypass due to improper handling of matrix parameters in url paths

Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision

Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint

Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation

Keycloak-core: keycloak environment information