KE
Vendor
Keycloak
18
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-90997 | KE Keycloak Keycloak | 7.4 | Sep 17 | Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch |
| CVE-2026-1609 | KE Keycloak Keycloak | 8.1 | Jul 16 | Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users |
| CVE-2025-12150 | KE keycloak Keycloak | 3.1 | Feb 27 | Org.keycloak/keycloak-services: webauthn attestation statement verification bypass |
| CVE-2025-13467 | KE Keycloak Keycloak | 5.5 | Nov 25 | Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation |
| CVE-2025-11538 | KE keycloak Keycloak | 6.8 | Nov 13 | Keycloak-server: debug default bind address |
| CVE-2025-12390 | KE keycloak Keycloak | 6.0 | Oct 28 | Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id |
| CVE-2025-10939 | KE keycloak Keycloak | 3.7 | Oct 28 | Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console |
| CVE-2025-12110 | KE keycloak Keycloak | 5.4 | Oct 23 | Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed |
| CVE-2025-11429 | KE keycloak Keycloak | 5.4 | Oct 23 | Keycloak-server: too long and not settings compliant session |
| CVE-2025-10044 | KE keycloak Keycloak | 4.3 | Sep 5 | Keycloak: keycloak error_description injection on error pages |
| CVE-2025-9162 | KE keycloak Keycloak | 4.9 | Aug 21 | Org.keycloak/keycloak-model-storage-service: variable injection into environment variables |
| CVE-2025-8419 | KE keycloak Keycloak | 5.3 | Aug 6 | Org.keycloak/keycloak-services: keycloak smtp inject vulnerability |
| CVE-2017-12161 | KE Keycloak Keycloak | 8.8 | Feb 21 | It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request |
| CVE-2014-3651 | KE Keycloak Keycloak | 7.5 | Dec 29 | JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR… |
| CVE-2017-12159 | KE Keycloak Keycloak | 7.5 | Oct 26 | It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session |
| CVE-2017-12158 | KE Keycloak Keycloak | 5.4 | Oct 26 | It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations |
| CVE-2014-3709 | KE Keycloak Keycloak | 8.8 | Oct 18 | The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF)… |
| CVE-2017-7474 | KE Keycloak-nodejs-auth-utils Keycloak | 9.8 | May 12 | It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly |