# org.keycloak:keycloak-parent (Maven) vulnerabilities 24 known vulnerabilities (3 critical, 2 high, 6 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://central.sonatype.com/artifact/org.keycloak/keycloak-parent ## Advisories (24) ### [CVE-2026-0707](https://cve.now/CVE-2026-0707): Keycloak: keycloak authorization header parsing leading to potential security control bypass - Severity: Medium 5.3 - Published: Jan 8, 2026 - Affected: through 26.5.0. ### [CVE-2022-4137](https://cve.now/CVE-2022-4137): Keycloak: reflected xss attack - Severity: High 8.1 - Published: Sep 25, 2023 - Affected: fixed in 20.0.5. ### [CVE-2022-3916](https://cve.now/CVE-2022-3916): Keycloak: session takeover with oidc offline refreshtokens - Severity: Medium 6.8 - Published: Sep 20, 2023 - Affected: fixed in 20.0.2. ### [CVE-2022-3782](https://cve.now/CVE-2022-3782): keycloak: path traversal via double URL encoding. - Severity: Critical 9.1 - Published: Jan 11, 2023 - Affected: fixed in 20.0.2. ### [CVE-2022-2256](https://cve.now/CVE-2022-2256): A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. - Severity: Unrated - Published: Sep 1, 2022 - Affected: fixed in 19.0.2. ### [CVE-2021-3513](https://cve.now/CVE-2021-3513): A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. - Severity: Unrated - Published: Aug 22, 2022 - Affected: fixed in 13.0.0. ### [CVE-2022-2668](https://cve.now/CVE-2022-2668): An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the… - Severity: Unrated - Published: Aug 5, 2022 - Affected: fixed in 19.0.2. ### [CVE-2021-3461](https://cve.now/CVE-2021-3461): A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity… - Severity: Unrated - Published: Apr 1, 2022 - Affected: fixed in 14.0.0. ### [CVE-2021-20222](https://cve.now/CVE-2021-20222): A flaw was found in keycloak. - Severity: Unrated - Published: Mar 23, 2021 - Affected: from 9.0.0, fixed in 12.0.3. ### [CVE-2020-1717](https://cve.now/CVE-2020-1717): A flaw was found in Keycloak 7.0.1. - Severity: Unrated - Published: Feb 11, 2021 - Affected: through 7.0.1. ### [CVE-2020-1725](https://cve.now/CVE-2020-1725): A flaw was found in keycloak before version 13.0.0. - Severity: Unrated - Published: Jan 28, 2021 - Affected: fixed in 13.0.0. ### [CVE-2020-14366](https://cve.now/CVE-2020-14366): A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the… - Severity: Medium 6.8 - Published: Nov 9, 2020 - Affected: fixed in 12.0.0. ### [CVE-2020-1694](https://cve.now/CVE-2020-1694): A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. - Severity: Unrated - Published: Sep 16, 2020 - Affected: fixed in 10.0.0. ### [CVE-2020-10748](https://cve.now/CVE-2020-10748): A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. - Severity: Unrated - Published: Sep 16, 2020 - Affected: fixed in 10.0.2. ### [CVE-2020-10758](https://cve.now/CVE-2020-10758): A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the… - Severity: Unrated - Published: Sep 16, 2020 - Affected: fixed in 11.0.1. ### [CVE-2020-1758](https://cve.now/CVE-2020-1758): A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using… - Severity: Medium 5.3 - Published: May 15, 2020 - Affected: fixed in 10.0.0. ### [CVE-2020-1718](https://cve.now/CVE-2020-1718): A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. - Severity: High 7.1 - Published: May 12, 2020 - Affected: fixed in 8.0.0. ### [CVE-2019-14910](https://cve.now/CVE-2019-14910): A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS… - Severity: Critical 9.3 - Published: Dec 5, 2019 - Affected: from 7.0.0, through 7.0.1. ### [CVE-2019-14909](https://cve.now/CVE-2019-14909): A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or… - Severity: Critical 9.3 - Published: Dec 4, 2019 - Affected: from 7.0.0, through 7.0.1. ### [CVE-2018-14657](https://cve.now/CVE-2018-14657): A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. - Severity: Medium 5.4 - Published: Nov 13, 2018 - Affected: fixed in 4.6.0.Final. ### [CVE-2018-14655](https://cve.now/CVE-2018-14655): A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. - Severity: Medium 4.6 - Published: Nov 13, 2018 - Affected: through 3.4.3.Final; from 4.0.0.Beta1, through 4.0.0.Beta2; versions 4.3.0.Final. ### [CVE-2017-12160](https://cve.now/CVE-2017-12160): It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication… - Severity: Unrated - Published: Oct 26, 2017 - Affected: fixed in 3.3.0.Final. ### [CVE-2017-12159](https://cve.now/CVE-2017-12159): It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. - Severity: Unrated - Published: Oct 26, 2017 - Affected: fixed in 3.4.0. ### [CVE-2017-12158](https://cve.now/CVE-2017-12158): It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. - Severity: Unrated - Published: Oct 26, 2017 - Affected: fixed in 3.4.0. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.keycloak:keycloak-parent Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.