Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token

Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability

Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition

Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass

Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)

Keycloak: potential bypass of brute force protection

Keycloak: vulnerable redirect uri validation results in open redirec

Keycloak-core: open redirect on account page

Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak

Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed

Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains

Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled

Org.keycloak.authentication: two factor authentication bypass

Keycloak: keycloak: denial of service via malformed authorization header

Keycloak: keycloak: information disclosure via saml ecp endpoint

Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim

Keycloak: keycloak: replay of action tokens via improper handling of single-use entries

Keycloak: keycloak: denial of service due to excessive samlrequest decompression

Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

Keycloak: keycloak: information disclosure through arbitrary filesystem path probing

Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak

Keycloak: keycloak: denial of service via malformed ldap password policy response

Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api

Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email

Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page

Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity

Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution

Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass

Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption

Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions

Keycloak: keycloak: brute-force protection bypass in ciba flow

Keycloak-rhel9: organization data leak after feature disabled in keycloak

Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint

Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation

Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api

Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control