Keycloak-services: keycloak-services: redirect uri domain allowlist bypass via dns resolution to loopback

Keycloak-services: keycloak-services: ciba confidential-only contract not enforced for public clients

Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding

Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers

Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled

Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation

Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission

Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership

Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade

Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration

Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read

Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission

Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling

Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing

Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough)

Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling

Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line

Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts

Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes

Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching

Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper

Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability

Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers

Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx

Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking

Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers

All versions of the package decompress are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) when extracting a ZIP archive containing two entries with the same…

Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus

Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload

Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak

Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uri

Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens

Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass

Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check

Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

Keycloak-services: keycloak-services: required actions bypassed via kc_action parameter

Keycloak-services: keycloak-services: par single-use bypass via flow restart

Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions

Keycloak-services: keycloak-services: device authorization grant bypasses per-client minimum.acr.value enforcement

Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains

Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support

Keycloak-services: keycloak-services: vault secret disclosure via client registration installation configuration

Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size

Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies

Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

Keycloak-core: dos via account lockout

Keycloak-services: sensitive headers shown in the http access logs

Keycloak-services: keycloak-services: view-clients role allows retrieval of active client secrets via installation provider endpoints

Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity