- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 48 · 2 critical, 5 high, 20 medium, 4 low
- Dependents
- 109
- Registry
- Maven Central
Advisories 48
- CVE-2024-4028Low 3.8
Keycloak-core: stored xss in keycloak when creating a items in admin console
Affected: through 26.1.2.
- CVE-2023-6841High 7.5
Keycloak: amount of attributes per object is not limited and it may lead to dos
Affected: fixed in 24.0.0.
- CVE-2024-7318Medium 4.8
Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity
Affected: fixed in 24.0.7; from 25.0.0, fixed in 25.0.4.
- CVE-2024-7260Medium 6.1
Keycloak-core: open redirect on account page
Affected: fixed in 24.0.7.
- CVE-2023-6927Medium 4.6
Keycloak: open redirect via "form_post.jwt" jarm response mode
Affected: fixed in 23.0.4.
- CVE-2023-4918High 8.8
Plaintext storage of user password
Affected: from 22.0.2, fixed in 22.0.3.
- CVE-2023-1664Medium 6.5
A flaw was found in Keycloak.
Affected: fixed in 21.1.2.
- CVE-2023-0105Medium 6.5
A flaw was found in Keycloak.
Affected: fixed in 22.0.1.
- CVE-2023-0091Low 3.8
A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow.
Affected: fixed in 20.0.3.
- CVE-2022-0225Unrated
A flaw was found in Keycloak.
Affected: fixed in 20.0.0; through 16.1.0.
- CVE-2021-3632Unrated
A flaw was found in Keycloak.
Affected: fixed in 15.1.0.
- CVE-2021-3856Unrated
ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader.
Affected: fixed in 15.1.0.
- CVE-2020-35509Medium 5.4
A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0.
Affected: fixed in 14.0.0.
- CVE-2022-1466Unrated
Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform.
Affected: fixed in 17.0.1.
- CVE-2021-20323Unrated
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
Affected: from 15.0.0, fixed in 17.0.0.
Show all 48 advisoriesShow fewer advisories
- CVE-2021-20195Unrated
A flaw was found in keycloak in versions before 13.0.0.
Affected: fixed in 13.0.0.
- CVE-2020-27826Unrated
A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API.
Affected: fixed in 12.0.0.
- CVE-2021-20202Unrated
A flaw was found in keycloak.
Affected: fixed in 13.0.0.
- CVE-2021-20262Unrated
A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password.
Affected: through 12.0.4.
- CVE-2020-27838Unrated
A flaw was found in keycloak in versions prior to 13.0.0.
Affected: fixed in 13.0.0.
- CVE-2020-10770Unrated
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC…
Affected: fixed in 13.0.0.
- CVE-2020-14389Unrated
It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new…
Affected: fixed in 12.0.0.
- CVE-2020-1714High 7.5
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.
Affected: fixed in 11.0.0.
- CVE-2020-1724Medium 4.3
A flaw was found in Keycloak in versions before 9.0.2.
Affected: fixed in 9.0.2.
- CVE-2020-1698Medium 5.0
A flaw was found in keycloak in versions before 9.0.0.
Affected: fixed in 9.0.0.
- CVE-2019-10170Medium 6.6
A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy.
Affected: fixed in 8.0.0.
- CVE-2020-10686Medium 4.1
A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself.
Affected: fixed in 9.0.2.
- CVE-2020-1728Medium 4.8
A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing…
Affected: through 9.0.3.
- CVE-2020-1744Medium 5.6
A flaw was found in keycloak before version 9.0.1.
Affected: fixed in 9.0.1.
- CVE-2020-1731Critical 9.1
A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random…
Affected: fixed in 8.0.2.
- CVE-2020-1697Medium 6.1
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not…
Affected: fixed in 9.0.0.
- CVE-2019-14820Medium 4.3
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can…
Affected: fixed in 8.0.0.
- CVE-2019-14837Critical 9.1
A flaw was found in keycloack before version 8.0.0.
Affected: fixed in 8.0.0.
- CVE-2014-3656Unrated
JBoss KeyCloak: XSS in login-status-iframe.html
Affected: fixed in 1.1.0.Beta1.
- CVE-2019-10201High 8.1
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures.
Affected: fixed in 7.0.0.
- CVE-2019-10199Medium 4.6
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests.
Affected: fixed in 7.0.0.
- CVE-2019-3875Medium 6.5
A vulnerability was found in keycloak before 6.0.2.
Affected: through 6.0.1.
- CVE-2019-3868Low 3.8
Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for…
Affected: fixed in 6.0.0.
- CVE-2018-14637Medium 6.1
The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions.
Affected: fixed in 4.6.0.
- CVE-2018-14658Medium 6.1
A flaw was found in JBOSS Keycloak 3.2.1.Final.
Affected: through 3.2.1.Final.
- CVE-2016-8609Low 3.7
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly.
Affected: fixed in 2.3.0.
- CVE-2017-2646High 7.5
It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the…
Affected: fixed in 2.5.5.
- CVE-2017-2582Medium 6.5
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining…
Affected: fixed in 2.5.1.
- CVE-2018-10912Medium 4.4
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement.
Affected: fixed in 4.0.0.
- CVE-2017-2585Unrated
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in…
Affected: fixed in 2.5.1.
- CVE-2016-8629Unrated
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the…
Affected: fixed in 2.4.0.
- CVE-2017-12161Unrated
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset…
Affected: fixed in 3.4.2.
- CVE-2014-3651Unrated
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the…
Affected: fixed in 1.0.3.