BO
Product
Build OF Keycloak
111
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 34Medium 66Low 9
Watch
Add Build OF Keycloak to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-14781 | 4.8 | Jul 5 | Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email Affected: All versions, or not specified |
| CVE-2026-37980 | 4.8 | Apr 14 | Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page Affected: All versions, or not specified |
| CVE-2024-7318 | 4.8 | Sep 9 | Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity Affected: 22.0 before 24.0.7 |
| CVE-2026-18209 | 4.7 | Jul 31 | Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check Affected: All versions, or not specified |
| CVE-2026-18217 | 4.7 | Jul 31 | Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution Affected: All versions, or not specified |
| CVE-2026-9799 | 4.6 | Jun 25 | Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass Affected: 26.4 before 26.4.13; 26.6 before 26.6.4 |
| CVE-2026-16103 | 4.3 | Jul 17 | Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption Affected: All versions, or not specified |
| CVE-2026-14209 | 4.3 | Jun 30 | Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions Affected: All versions, or not specified |
| CVE-2026-9798 | 4.3 | May 28 | Keycloak: keycloak: brute-force protection bypass in ciba flow Affected: All versions, or not specified |
| CVE-2026-9791 | 4.3 | May 28 | Keycloak-rhel9: organization data leak after feature disabled in keycloak Affected: All versions, or not specified |
| CVE-2026-37981 | 4.3 | May 19 | Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint Affected: 26.4 before 26.4.12 |
| CVE-2026-8830 | 4.3 | May 19 | Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation Affected: All versions, or not specified |
| CVE-2026-3190 | 4.3 | Mar 26 | Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api Affected: All versions, or not specified |
| CVE-2026-4628 | 4.3 | Mar 23 | Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control Affected: All versions, or not specified |
| CVE-2026-9689 | 4.2 | May 27 | Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604 Affected: All versions, or not specified |
| CVE-2026-3429 | 4.2 | Mar 11 | Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api Affected: 26.4 before 26.4.11 |