- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 24 · 3 critical, 2 high, 6 medium
- Registry
- Maven Central
Advisories 24
- CVE-2026-0707Medium 5.3
Keycloak: keycloak authorization header parsing leading to potential security control bypass
Affected: through 26.5.0.
- CVE-2022-4137High 8.1
Keycloak: reflected xss attack
Affected: fixed in 20.0.5.
- CVE-2022-3916Medium 6.8
Keycloak: session takeover with oidc offline refreshtokens
Affected: fixed in 20.0.2.
- CVE-2022-3782Critical 9.1
keycloak: path traversal via double URL encoding.
Affected: fixed in 20.0.2.
- CVE-2022-2256Unrated
A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7.
Affected: fixed in 19.0.2.
- CVE-2021-3513Unrated
A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled.
Affected: fixed in 13.0.0.
- CVE-2022-2668Unrated
An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the…
Affected: fixed in 19.0.2.
- CVE-2021-3461Unrated
A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity…
Affected: fixed in 14.0.0.
- CVE-2021-20222Unrated
A flaw was found in keycloak.
Affected: from 9.0.0, fixed in 12.0.3.
- CVE-2020-1717Unrated
A flaw was found in Keycloak 7.0.1.
Affected: through 7.0.1.
- CVE-2020-1725Unrated
A flaw was found in keycloak before version 13.0.0.
Affected: fixed in 13.0.0.
- CVE-2020-14366Medium 6.8
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the…
Affected: fixed in 12.0.0.
- CVE-2020-1694Unrated
A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience.
Affected: fixed in 10.0.0.
- CVE-2020-10748Unrated
A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances.
Affected: fixed in 10.0.2.
- CVE-2020-10758Unrated
A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the…
Affected: fixed in 11.0.1.
Show all 24 advisoriesShow fewer advisories
- CVE-2020-1758Medium 5.3
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using…
Affected: fixed in 10.0.0.
- CVE-2020-1718High 7.1
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0.
Affected: fixed in 8.0.0.
- CVE-2019-14910Critical 9.3
A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS…
Affected: from 7.0.0, through 7.0.1.
- CVE-2019-14909Critical 9.3
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or…
Affected: from 7.0.0, through 7.0.1.
- CVE-2018-14657Medium 5.4
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final.
Affected: fixed in 4.6.0.Final.
- CVE-2018-14655Medium 4.6
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final.
Affected: through 3.4.3.Final; from 4.0.0.Beta1, through 4.0.0.Beta2; versions 4.3.0.Final.
- CVE-2017-12160Unrated
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication…
Affected: fixed in 3.3.0.Final.
- CVE-2017-12159Unrated
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session.
Affected: fixed in 3.4.0.
- CVE-2017-12158Unrated
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations.
Affected: fixed in 3.4.0.