Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.keycloak:keycloak-server-spi-private

7 known vulnerabilities (1 high, 4 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
7 · 1 high, 4 medium, 1 low
Dependents
86
Registry
Maven Central

Advisories 7

  • CVE-2026-9791Medium 4.3

    Keycloak-rhel9: organization data leak after feature disabled in keycloak

    Affected: from 26.5.0, fixed in 26.6.3; through 26.4.7.

  • CVE-2026-9704Medium 6.8

    Keycloak: keycloak: privilege escalation due to oversized subject_token jwt

    Affected: fixed in 26.6.3.

  • CVE-2026-3190Medium 4.3

    Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api

    Affected: fixed in 26.5.6.

  • Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

    Affected: fixed in 26.5.5.

  • CVE-2026-0871Medium 4.9

    Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

    Affected: fixed in 26.5.2.

  • Keycloak: client access via device auth request spoof

    Affected: fixed in 21.1.2.

  • A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter.

    Affected: fixed in 12.0.0.