org.keycloak:keycloak-services

Keycloak-rhel9: organization data leak after feature disabled in keycloak

Affected: from 26.5.0, fixed in 26.6.3; through 26.4.7.

Fixed in 26.6.3 (released Jun 4, 2026, 7 days after disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: privilege escalation due to oversized subject_token jwt

Affected: fixed in 26.6.3.

Fixed in 26.6.3 (released Jun 4, 2026, 8 days after disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604

Affected: from 26.5.0, through 26.6.4; through 26.4.7.

Fixed in 26.7.0 (released Jul 9, 2026, 43 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

Affected: fixed in 26.6.3.

Fixed in 26.6.3 (released Jun 4, 2026, 15 days after disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data

Affected: fixed in 26.6.2.

Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

Affected: fixed in 26.6.2.

Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak

Affected: fixed in 26.6.2.

Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay

Affected: fixed in 26.6.2.

Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass

Affected: fixed in 26.6.2.

Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api

Affected: fixed in 26.6.2.

Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint

Affected: fixed in 26.4.12; from 26.5.0, fixed in 26.6.2.

Fixed in 26.6.2 (released May 19, 2026, the day of disclosure, the advisory names 26.4.12, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference

Affected: fixed in 26.6.2.

Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

Affected: through 26.6.2.

Fixed in 26.6.3 (released Jun 4, 2026, 16 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript…

Affected: fixed in 26.6.3.

Fixed in 26.6.3 (released Jun 4, 2026, 16 days after disclosure).

The latest release, 26.8.2, is not affected.

Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled

Affected: through 26.6.1.

Fixed in 26.6.2 (released May 19, 2026, 19 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page

Affected: through 26.5.5.

Fixed in 26.5.6 (released Mar 19, 2026, 26 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp…

Affected: fixed in 26.4.13; from 26.5.0, fixed in 26.6.3.

Fixed in 26.6.3 (released Jun 4, 2026, 59 days after disclosure, the advisory names 26.4.13, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

Affected: fixed in 26.5.7.

Fixed in 26.5.7 (released Apr 2, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

Affected: fixed in 26.5.7.

Fixed in 26.5.7 (released Apr 2, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: replay of action tokens via improper handling of single-use entries

Affected: fixed in 26.5.7.

Fixed in 26.5.7 (released Apr 2, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

Affected: fixed in 26.5.7.

Fixed in 26.5.7 (released Apr 2, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: information disclosure due to redirect_uri validation bypass

Affected: fixed in 26.5.7.

Fixed in 26.5.7 (released Apr 2, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

Affected: fixed in 26.5.6.

Fixed in 26.5.6 (released Mar 19, 2026, 7 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api

Affected: fixed in 26.5.6.

Fixed in 26.5.6 (released Mar 19, 2026, 7 days before disclosure).

The latest release, 26.8.2, is not affected.

Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint…

Affected: from 26.5.0, fixed in 26.6.3; fixed in 26.4.13.

Fixed in 26.6.3 (released Jun 4, 2026, 70 days after disclosure, the advisory names 26.4.13, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: user enumeration via differential error messages

Affected: from 26.5.0, fixed in 26.6.1; fixed in 26.4.12.

Fixed in 26.6.1 (released Apr 15, 2026, 23 days after disclosure, the advisory names 26.4.12, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control

Affected: through 26.6.0.

Fixed in 26.6.1 (released Apr 15, 2026, 23 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: denial of service due to excessive samlrequest decompression

Affected: fixed in 26.5.4.

Fixed in 26.5.4 (released Feb 20, 2026, 26 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

Affected: fixed in 26.5.5.

Fixed in 26.5.5 (released Mar 5, 2026, 13 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

Affected: through 26.2.5; from 26.3.0, through 26.4.7; from 26.5.0.

No fix released. The latest release, 26.8.2, is still affected.

Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api

Affected: through 26.5.6.

Fixed in 26.5.7 (released Apr 2, 2026, 22 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint

Affected: through 26.5.5.

Fixed in 26.5.6 (released Mar 19, 2026, 8 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

Affected: fixed in 26.5.5.

Fixed in 26.5.5 (released Mar 5, 2026, the day of disclosure).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

Affected: fixed in 26.4.4.

Fixed in 26.4.4 (released Nov 7, 2025, 112 days before disclosure).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol

Affected: through 26.5.3.

Fixed in 26.5.4 (released Feb 20, 2026, 1 day after disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Keycloak: incorrect ownership checks in /uma-policy/

Affected: fixed in 26.2.13; from 26.5.0, fixed in 26.5.3; from 26.3.0, fixed in 26.4.9.

Fixed in 26.5.3 (released Feb 10, 2026, 1 day after disclosure, the advisory names 26.2.13, which was never published).

The latest release, 26.8.2, is not affected.

Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation

Affected: from 26.5.0, fixed in 26.5.3; fixed in 26.2.13; from 26.3.0, fixed in 26.4.9.

Fixed in 26.5.3 (released Feb 10, 2026, 1 day after disclosure, the advisory names 26.2.13, which was never published).

The latest release, 26.8.2, is not affected.

Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant

Affected: from 26.5.0, fixed in 26.5.3; fixed in 26.4.9.

Fixed in 26.5.3 (released Feb 10, 2026, 1 day after disclosure, the advisory names 26.4.9, which was never published).

The latest release, 26.8.2, is not affected.

Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api

Affected: from 26.5.0, fixed in 26.5.2; fixed in 26.4.9.

Fixed in 26.5.2 (released Jan 23, 2026, 10 days before disclosure, the advisory names 26.4.9, which was never published).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata

Affected: through 26.5.2.

Fixed in 26.5.3 (released Feb 10, 2026, 15 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure

Affected: through 26.2.5.

Fixed in 26.3.0 (released Jul 1, 2025, 204 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users

Affected: from 26.5.0, fixed in 26.5.2; fixed in 26.4.9.

Fixed in 26.5.2 (released Jan 23, 2026, 2 days after disclosure, the advisory names 26.4.9, which was never published).

The latest release, 26.8.2, is not affected.

Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition

Affected: through 26.2.5.

Fixed in 26.3.0 (released Jul 1, 2025, 204 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure

Affected: fixed in 26.5.0.

Fixed in 26.5.0 (released Jan 6, 2026, 27 days after disclosure).

The latest release, 26.8.2, is not affected.

Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id

Affected: fixed in 26.0.0.

Fixed in 26.0.0 (released Oct 4, 2024, 389 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed

Affected: fixed in 26.2.3.

Fixed in 26.2.3 (released May 5, 2025, 171 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak-server: too long and not settings compliant session

Affected: from 26.3.0, fixed in 26.4.1; fixed in 26.2.11.

Fixed in 26.4.1 (released Oct 16, 2025, 7 days before disclosure, the advisory names 26.2.11, which was never published).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

Affected: fixed in 26.2.8; from 26.3.0, fixed in 26.3.3.

Fixed in 26.3.3 (released Aug 20, 2025, 14 days after disclosure, the advisory names 26.2.8, which was never published).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)

Affected: from 26.2.0, fixed in 26.2.6.

Fixed in 26.3.0 (released Jul 1, 2025, 17 days before disclosure, the advisory names 26.2.6, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: phishing attack via email verification step in first login flow

Affected: fixed in 26.0.13; from 26.2.0, fixed in 26.2.6.

Fixed in 26.1.0 (released Jan 15, 2025, 176 days before disclosure, the advisory names 26.0.13, which was never published) and 26.3.0 (released Jul 1, 2025, 9 days before disclosure, the advisory names 26.2.6, which was never published).

The latest release, 26.8.2, is not affected.

Org.keycloak.authentication: two factor authentication bypass

Affected: fixed in 26.2.2.

Fixed in 26.2.2 (released Apr 30, 2025, 1 day after disclosure).

The latest release, 26.8.2, is not affected.

Org.keycloak.protocol.services: keycloak hostname verification

Affected: fixed in 26.2.2.

Fixed in 26.2.2 (released Apr 30, 2025, 1 day after disclosure).

The latest release, 26.8.2, is not affected.

Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak

Affected: through 26.1.4.

Fixed in 26.1.5 (released Apr 11, 2025, 17 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims

Affected: from 26.1.0, fixed in 26.1.3; fixed in 26.0.10.

Fixed in 26.1.3 (released Feb 28, 2025, 11 days after disclosure, the advisory names 26.0.10, which was never published).

The latest release, 26.8.2, is not affected.

Org.keycloak:keycloak-services: keycloak denial of service

Affected: fixed in 24.0.9; from 25.0.0, fixed in 26.0.6.

Fixed in 26.0.6 (released Nov 22, 2024, 3 days before disclosure, the advisory names 24.0.9, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: impersonation via logout token exchange

Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.

Fixed in 24.0.3 (released Apr 16, 2024, 215 days before disclosure, the advisory names 22.0.10, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: ldap injection on username input

Affected: fixed in 23.0.1.

Fixed in 23.0.1 (released Nov 29, 2023, 351 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

Affected: fixed in 24.0.5.

Fixed in 24.0.5 (released Jun 4, 2024, 127 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: vulnerable redirect uri validation results in open redirec

Affected: fixed in 22.0.13; from 23.0.0, fixed in 24.0.8; from 25.0.0, fixed in 25.0.6.

Fixed in 25.0.6 (released Sep 19, 2024, the day of disclosure, the advisory names 22.0.13, which was never published).

The latest release, 26.8.2, is not affected.

Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

Affected: fixed in 22.0.12; from 23.0.0, fixed in 24.0.7; from 25.0.0, fixed in 25.0.5.

Fixed in 25.0.5 (released Sep 10, 2024, 1 day after disclosure, the advisory names 22.0.12, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: potential bypass of brute force protection

Affected: fixed in 22.0.12; from 23.0.0, fixed in 24.0.7; from 25.0.0, fixed in 25.0.4.

Fixed in 25.0.4 (released Aug 19, 2024, 15 days before disclosure, the advisory names 22.0.12, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie

Affected: fixed in 24.0.5.

Fixed in 24.0.5 (released Jun 4, 2024, 1 day after disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: session hijacking via re-authentication

Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.

Fixed in 24.0.3 (released Apr 16, 2024, 9 days before disclosure, the advisory names 22.0.10, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: xss via assertion consumer service url in saml post-binding flow

Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.

Fixed in 24.0.3 (released Apr 16, 2024, 9 days before disclosure, the advisory names 22.0.10, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: authorization bypass

Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.

Fixed in 24.0.3 (released Apr 16, 2024, 9 days before disclosure, the advisory names 22.0.10, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: log injection during webauthn authentication or registration

Affected: fixed in 22.0.9; from 23.0.0, fixed in 23.0.5.

Fixed in 23.0.5 (released Jan 29, 2024, 87 days before disclosure, the advisory names 22.0.9, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: secondary factor bypass in step-up authentication

Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.

Fixed in 24.0.3 (released Apr 16, 2024, 9 days before disclosure, the advisory names 22.0.10, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: path traversal in the redirect validation

Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.

Fixed in 24.0.3 (released Apr 16, 2024, 1 day before disclosure, the advisory names 22.0.10, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.

Fixed in 24.0.3 (released Apr 16, 2024, 1 day before disclosure, the advisory names 22.0.10, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak: path transversal in redirection validation

Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.

Fixed in 24.0.3 (released Apr 16, 2024, 1 day before disclosure, the advisory names 22.0.10, which was never published).

The latest release, 26.8.2, is not affected.

Keycloak-core: dos via account lockout

Affected: fixed in 24.0.0.

Fixed in 24.0.0 (released Mar 4, 2024, 6 days after disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: redirect_uri validation bypass

Affected: fixed in 23.0.3.

Fixed in 23.0.3 (released Dec 15, 2023, 42 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: client access via device auth request spoof

Affected: fixed in 21.1.2.

Fixed in 21.1.2 (released Jun 28, 2023, 176 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: reflected xss via wildcard in oidc redirect_uri

Affected: fixed in 23.0.3.

Fixed in 23.0.3 (released Dec 15, 2023, 1 day after disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: oauth client impersonation

Affected: fixed in 21.1.2.

Fixed in 21.1.2 (released Jun 28, 2023, 98 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak: xss on impersonation under specific circumstances

Affected: through 21.0.0.

Fixed in 21.0.1 (released Mar 1, 2023, 203 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

The latest release, 26.8.2, is not affected.

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests.

Affected: fixed in 21.0.1.

Fixed in 21.0.1 (released Mar 1, 2023, 156 days before disclosure).

The latest release, 26.8.2, is not affected.

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC…

Affected: fixed in 21.1.2.

Fixed in 21.1.2 (released Jun 28, 2023, 9 days before disclosure).

The latest release, 26.8.2, is not affected.

A flaw was found in Keycloak in the execute-actions-email endpoint.

Affected: fixed in 20.0.5.

Fixed in 20.0.5 (released Feb 21, 2023, 36 days before disclosure).

The latest release, 26.8.2, is not affected.

A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user.

Affected: fixed in 24.0.1.

Fixed in 24.0.1 (released Mar 5, 2024, 557 days after disclosure).

The latest release, 26.8.2, is not affected.

A privilege escalation flaw was found in the token exchange feature of keycloak.

Affected: fixed in 18.0.0.

Fixed in 18.0.0 (released Apr 20, 2022, 78 days before disclosure).

The latest release, 26.8.2, is not affected.

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create…

Affected: fixed in 15.1.1.

Fixed in 15.1.1 (released Dec 17, 2021, 39 days before disclosure).

The latest release, 26.8.2, is not affected.

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible.

Affected: fixed in 18.0.0.

Fixed in 18.0.0 (released Apr 20, 2022, 323 days after disclosure).

The latest release, 26.8.2, is not affected.

A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter.

Affected: fixed in 12.0.0.

Fixed in 12.0.0 (released Dec 16, 2020, 29 days after disclosure).

The latest release, 26.8.2, is not affected.

JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.

Affected: fixed in 1.1.0.Beta1.

Fixed in 1.1.0.Beta1 (released Nov 4, 2014, 1867 days before disclosure).

The latest release, 26.8.2, is not affected.

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

Affected: fixed in 1.0.2.Final.

Fixed in 1.0.2.Final (released Oct 8, 2014, 1862 days before disclosure).

The latest release, 26.8.2, is not affected.

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates.

Affected: fixed in 4.4.0.Final.

Fixed in 4.4.0.Final (released Sep 5, 2018, 35 days after disclosure).

The latest release, 26.8.2, is not affected.

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct…

Affected: fixed in 1.0.3.Final.

Fixed in 1.0.3.Final (released Oct 28, 2014, 1086 days before disclosure).

The latest release, 26.8.2, is not affected.