# org.keycloak:keycloak-services (Maven) vulnerabilities

103 known vulnerabilities (2 critical, 26 high, 50 medium, 15 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 26.8.2 (Nov 5, 2026): affected by CVE-2026-2092
- Newest unaffected release: Every release is affected by at least one advisory
- Dependents: 74
- Releases: 238 since 1.0-final (Sep 10, 2014)
- Registry: https://central.sonatype.com/artifact/org.keycloak/keycloak-services
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-18963: 26.0.0 to 26.7.1 (26.7.2 is outside it)
- CVE-2026-11800: 1.0-alpha-1 to 26.6.3 (26.6.4 is outside it)
- CVE-2026-9083: 1.0-alpha-1 to 26.6.3 (26.6.4 is outside it)
- CVE-2026-9799: 1.0-alpha-1 to 26.6.3 (26.6.4 is outside it)
- CVE-2026-9705: 1.0-alpha-1 to 26.6.3 (26.6.4 is outside it)
- CVE-2026-9086: 1.0-alpha-1 to 26.6.3 (26.6.4 is outside it)
- CVE-2026-9800: 1.0-alpha-1 to 26.6.3 (26.6.4 is outside it)
- CVE-2026-9088: 1.0-alpha-1 to 26.6.4 (26.7.0 is outside it)
- CVE-2026-9802: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-9803: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-9798: 1.0-alpha-1 to 26.6.4 (26.7.0 is outside it)
- CVE-2026-9795: 1.0-alpha-1 to 26.6.3 (26.6.4 is outside it)
- CVE-2026-9794: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-9792: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-9793: 1.0-alpha-1 to 26.6.4 (26.7.0 is outside it)
- CVE-2026-9791: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-9704: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-9689: 1.0-alpha-1 to 26.6.4 (26.7.0 is outside it)
- CVE-2026-9087: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-7571: 1.0-alpha-1 to 26.6.1 (26.6.2 is outside it)
- CVE-2026-7507: 1.0-alpha-1 to 26.6.1 (26.6.2 is outside it)
- CVE-2026-7504: 1.0-alpha-1 to 26.6.1 (26.6.2 is outside it)
- CVE-2026-37982: 1.0-alpha-1 to 26.6.1 (26.6.2 is outside it)
- CVE-2026-37979: 1.0-alpha-1 to 26.6.1 (26.6.2 is outside it)
- CVE-2026-37978: 1.0-alpha-1 to 26.6.1 (26.6.2 is outside it)
- CVE-2026-37981: 1.0-alpha-1 to 26.6.1 (26.6.2 is outside it)
- CVE-2026-4630: 1.0-alpha-1 to 26.6.1 (26.6.2 is outside it)
- CVE-2026-8922: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-8830: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-7500: 1.0-alpha-1 to 26.6.1 (26.6.2 is outside it)
- CVE-2026-37980: 1.0-alpha-1 to 26.5.5 (26.5.6 is outside it)
- CVE-2026-37977: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-4636: 1.0-alpha-1 to 26.5.6 (26.5.7 is outside it)
- CVE-2026-4634: 1.0-alpha-1 to 26.5.6 (26.5.7 is outside it)
- CVE-2026-4325: 1.0-alpha-1 to 26.5.6 (26.5.7 is outside it)
- CVE-2026-4282: 1.0-alpha-1 to 26.5.6 (26.5.7 is outside it)
- CVE-2026-3872: 1.0-alpha-1 to 26.5.6 (26.5.7 is outside it)
- CVE-2026-3121: 1.0-alpha-1 to 26.5.5 (26.5.6 is outside it)
- CVE-2026-3190: 1.0-alpha-1 to 26.5.5 (26.5.6 is outside it)
- CVE-2026-4874: 1.0-alpha-1 to 26.6.2 (26.6.3 is outside it)
- CVE-2026-4633: 1.0-alpha-1 to 26.6.0 (26.6.1 is outside it)
- CVE-2026-4628: 1.0-alpha-1 to 26.6.0 (26.6.1 is outside it)
- CVE-2026-2575: 1.0-alpha-1 to 26.5.3 (26.5.4 is outside it)
- CVE-2026-2603: 1.0-alpha-1 to 26.5.4 (26.5.5 is outside it)
- CVE-2026-2092: 1.0-alpha-1 to 26.8.2 (through the newest release)
- CVE-2026-3429: 1.0-alpha-1 to 26.5.6 (26.5.7 is outside it)
- CVE-2026-3911: 1.0-alpha-1 to 26.5.5 (26.5.6 is outside it)
- CVE-2026-3009: 1.0-alpha-1 to 26.5.4 (26.5.5 is outside it)
- CVE-2025-12150: 1.0-alpha-1 to 26.4.3 (26.4.4 is outside it)
- CVE-2026-2733: 1.0-alpha-1 to 26.5.3 (26.5.4 is outside it)
- CVE-2025-14778: 1.0-alpha-1 to 26.5.2 (26.5.3 is outside it)
- CVE-2026-1529: 1.0-alpha-1 to 26.5.2 (26.5.3 is outside it)
- CVE-2026-1486: 1.0-alpha-1 to 26.5.2 (26.5.3 is outside it)
- CVE-2025-13881: 1.0-alpha-1 to 26.5.1 (26.5.2 is outside it)
- CVE-2026-1190: 1.0-alpha-1 to 26.5.2 (26.5.3 is outside it)
- CVE-2025-14083: 1.0-alpha-1 to 26.2.5 (26.3.0 is outside it)
- CVE-2025-14559: 1.0-alpha-1 to 26.5.1 (26.5.2 is outside it)
- CVE-2026-1035: 1.0-alpha-1 to 26.2.5 (26.3.0 is outside it)
- CVE-2025-14082: 1.0-alpha-1 to 26.4.7 (26.5.0 is outside it)
- CVE-2025-12390: 1.0-alpha-1 to 25.0.6 (26.0.0 is outside it)
- CVE-2025-12110: 1.0-alpha-1 to 26.2.2 (26.2.3 is outside it)
- CVE-2025-11429: 1.0-alpha-1 to 26.4.0 (26.4.1 is outside it)
- CVE-2025-8419: 1.0-alpha-1 to 26.3.2 (26.3.3 is outside it)
- CVE-2025-7784: 26.2.0 to 26.2.5 (26.3.0 is outside it)
- CVE-2025-7365: 1.0-alpha-1 to 26.0.8 (26.1.0 is outside it); 26.2.0 to 26.2.5 (26.3.0 is outside it)
- CVE-2025-3910: 1.0-alpha-1 to 26.2.1 (26.2.2 is outside it)
- CVE-2025-3501: 1.0-alpha-1 to 26.2.1 (26.2.2 is outside it)
- CVE-2025-2559: 1.0-alpha-1 to 26.1.4 (26.1.5 is outside it)
- CVE-2025-1391: 1.0-alpha-1 to 26.1.2 (26.1.3 is outside it)
- CVE-2024-10270: 1.0-alpha-1 to 26.0.5 (26.0.6 is outside it)
- CVE-2023-0657: 1.0-alpha-1 to 24.0.2 (24.0.3 is outside it)
- CVE-2022-2232: 1.0-alpha-1 to 23.0.0 (23.0.1 is outside it)
- CVE-2024-3656: 1.0-alpha-1 to 24.0.4 (24.0.5 is outside it)
- CVE-2024-8883: 1.0-alpha-1 to 25.0.5 (25.0.6 is outside it)
- CVE-2024-7341: 1.0-alpha-1 to 25.0.4 (25.0.5 is outside it)
- CVE-2024-4629: 1.0-alpha-1 to 25.0.3 (25.0.4 is outside it)
- CVE-2024-4540: 1.0-alpha-1 to 24.0.4 (24.0.5 is outside it)
- CVE-2023-6787: 1.0-alpha-1 to 24.0.2 (24.0.3 is outside it)
- CVE-2023-6717: 1.0-alpha-1 to 24.0.2 (24.0.3 is outside it)
- CVE-2023-6544: 1.0-alpha-1 to 24.0.2 (24.0.3 is outside it)
- CVE-2023-6484: 1.0-alpha-1 to 23.0.4 (23.0.5 is outside it)
- CVE-2023-3597: 1.0-alpha-1 to 24.0.2 (24.0.3 is outside it)
- CVE-2024-2419: 1.0-alpha-1 to 24.0.2 (24.0.3 is outside it)
- CVE-2024-1249: 1.0-alpha-1 to 24.0.2 (24.0.3 is outside it)
- CVE-2024-1132: 1.0-alpha-1 to 24.0.2 (24.0.3 is outside it)
- CVE-2024-1722: 1.0-alpha-1 to 23.0.7 (24.0.0 is outside it)
- CVE-2023-6291: 1.0-alpha-1 to 23.0.2 (23.0.3 is outside it)
- CVE-2023-2585: 1.0-alpha-1 to 21.1.1 (21.1.2 is outside it)
- CVE-2023-6134: 1.0-alpha-1 to 23.0.2 (23.0.3 is outside it)
- CVE-2023-2422: 1.0-alpha-1 to 21.1.1 (21.1.2 is outside it)
- CVE-2022-1438: 1.0-alpha-1 to 21.0.0 (21.0.1 is outside it)
- CVE-2023-0264: 1.0-alpha-1 to 21.0.0 (21.0.1 is outside it)
- CVE-2022-4361: 1.0-alpha-1 to 21.1.1 (21.1.2 is outside it)
- CVE-2022-1274: 1.0-alpha-1 to 20.0.4 (20.0.5 is outside it)
- CVE-2021-3754: 1.0-alpha-1 to 24.0.0 (24.0.1 is outside it)
- CVE-2022-1245: 1.0-alpha-1 to 17.0.1 (18.0.0 is outside it)
- CVE-2021-4133: 1.0-alpha-1 to 15.1.0 (15.1.1 is outside it)
- CVE-2021-3424: 1.0-alpha-1 to 17.0.1 (18.0.0 is outside it)
- CVE-2020-10776: 1.0-alpha-1 to 11.0.3 (12.0.0 is outside it)
- CVE-2014-3652: 1.0-alpha-1 to 1.0.5.Final (1.1.0.Beta1 is outside it)
- CVE-2014-3655: 1.0-alpha-1 to 1.0.1.Final (1.0.2.Final is outside it)
- CVE-2018-10894: 1.0-alpha-1 to 4.3.0.Final (4.4.0.Final is outside it)
- CVE-2014-3709: 1.0-alpha-1 to 1.0.2.Final (1.0.3.Final is outside it)

## Advisories (103)

### [CVE-2026-18963](https://cve.now/CVE-2026-18963): Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

- Severity: Critical 9.1
- Published: Aug 18, 2026
- Affected: from 26.0.0, fixed in 26.4.15; from 26.5.0, fixed in 26.6.6; from 26.7.0, fixed in 26.7.2.
- Fixed in 26.7.2 (released Aug 19, 2026, 1 day after disclosure, the advisory names 26.4.15, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-11800](https://cve.now/CVE-2026-11800): Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion

- Severity: High 8.1
- Published: Jun 25, 2026
- Affected: fixed in 26.6.4.
- Fixed in 26.6.4 (released Jun 26, 2026, 1 day after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9083](https://cve.now/CVE-2026-9083): Keycloak: keycloak: information disclosure through arbitrary filesystem path probing

- Severity: Medium 4.9
- Published: Jun 25, 2026
- Affected: fixed in 26.6.4.
- Fixed in 26.6.4 (released Jun 26, 2026, 1 day after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9799](https://cve.now/CVE-2026-9799): Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass

- Severity: Medium 4.6
- Published: Jun 25, 2026
- Affected: fixed in 26.6.4.
- Fixed in 26.6.4 (released Jun 26, 2026, 1 day after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9705](https://cve.now/CVE-2026-9705): Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token

- Severity: Medium 6.5
- Published: Jun 25, 2026
- Affected: fixed in 26.6.4.
- Fixed in 26.6.4 (released Jun 26, 2026, 1 day after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9086](https://cve.now/CVE-2026-9086): Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

- Severity: High 7.3
- Published: Jun 25, 2026
- Affected: fixed in 26.6.4.
- Fixed in 26.6.4 (released Jun 26, 2026, 1 day after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9800](https://cve.now/CVE-2026-9800): Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

- Severity: High 8.1
- Published: Jun 25, 2026
- Affected: fixed in 26.6.4.
- Fixed in 26.6.4 (released Jun 26, 2026, 1 day after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9088](https://cve.now/CVE-2026-9088): Keycloak: keycloak: information disclosure due to user profile permission bypass

- Severity: Low 2.7
- Published: Jun 5, 2026
- Affected: fixed in 26.7.0.
- Fixed in 26.7.0 (released Jul 9, 2026, 34 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9802](https://cve.now/CVE-2026-9802): Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart

- Severity: Medium 6.8
- Published: May 28, 2026
- Affected: through 26.4.7; from 26.5.0, fixed in 26.6.3.
- Fixed in 26.6.3 (released Jun 4, 2026, 7 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9803](https://cve.now/CVE-2026-9803): Keycloak: keycloak: denial of service via malformed authorization header

- Severity: Medium 5.3
- Published: May 28, 2026
- Affected: through 26.4.7; from 26.5.0, fixed in 26.6.3.
- Fixed in 26.6.3 (released Jun 4, 2026, 7 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9798](https://cve.now/CVE-2026-9798): Keycloak: keycloak: brute-force protection bypass in ciba flow

- Severity: Medium 4.3
- Published: May 28, 2026
- Affected: through 26.4.7; from 26.5.0, through 26.6.4.
- Fixed in 26.7.0 (released Jul 9, 2026, 42 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9795](https://cve.now/CVE-2026-9795): Keycloak: keycloak: privilege escalation via improper scope mapping enforcement

- Severity: High 7.3
- Published: May 28, 2026
- Affected: fixed in 26.6.4.
- Fixed in 26.6.4 (released Jun 26, 2026, 29 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9794](https://cve.now/CVE-2026-9794): Keycloak: keycloak: information disclosure via saml ecp endpoint

- Severity: Medium 5.3
- Published: May 28, 2026
- Affected: through 26.4.7; from 26.5.0, fixed in 26.6.3.
- Fixed in 26.6.3 (released Jun 4, 2026, 7 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9792](https://cve.now/CVE-2026-9792): Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition

- Severity: Medium 6.5
- Published: May 28, 2026
- Affected: from 26.5.0, fixed in 26.6.3; through 26.4.7.
- Fixed in 26.6.3 (released Jun 4, 2026, 7 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9793](https://cve.now/CVE-2026-9793): Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing

- Severity: Medium 5.9
- Published: May 28, 2026
- Affected: through 26.6.4.
- Fixed in 26.7.0 (released Jul 9, 2026, 42 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9791](https://cve.now/CVE-2026-9791): Keycloak-rhel9: organization data leak after feature disabled in keycloak

- Severity: Medium 4.3
- Published: May 28, 2026
- Affected: from 26.5.0, fixed in 26.6.3; through 26.4.7.
- Fixed in 26.6.3 (released Jun 4, 2026, 7 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9704](https://cve.now/CVE-2026-9704): Keycloak: keycloak: privilege escalation due to oversized subject\_token jwt

- Severity: Medium 6.8
- Published: May 27, 2026
- Affected: fixed in 26.6.3.
- Fixed in 26.6.3 (released Jun 4, 2026, 8 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9689](https://cve.now/CVE-2026-9689): Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604

- Severity: Medium 4.2
- Published: May 27, 2026
- Affected: from 26.5.0, through 26.6.4; through 26.4.7.
- Fixed in 26.7.0 (released Jul 9, 2026, 43 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-9087](https://cve.now/CVE-2026-9087): Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

- Severity: Medium 6.4
- Published: May 20, 2026
- Affected: fixed in 26.6.3.
- Fixed in 26.6.3 (released Jun 4, 2026, 15 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-7571](https://cve.now/CVE-2026-7571): Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data

- Severity: High 7.1
- Published: May 19, 2026
- Affected: fixed in 26.6.2.
- Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-7507](https://cve.now/CVE-2026-7507): Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

- Severity: High 7.5
- Published: May 19, 2026
- Affected: fixed in 26.6.2.
- Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-7504](https://cve.now/CVE-2026-7504): Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak

- Severity: High 8.1
- Published: May 19, 2026
- Affected: fixed in 26.6.2.
- Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-37982](https://cve.now/CVE-2026-37982): Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay

- Severity: Medium 6.8
- Published: May 19, 2026
- Affected: fixed in 26.6.2.
- Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-37979](https://cve.now/CVE-2026-37979): Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass

- Severity: Medium 6.5
- Published: May 19, 2026
- Affected: fixed in 26.6.2.
- Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-37978](https://cve.now/CVE-2026-37978): Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api

- Severity: Medium 4.9
- Published: May 19, 2026
- Affected: fixed in 26.6.2.
- Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-37981](https://cve.now/CVE-2026-37981): Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint

- Severity: Medium 4.3
- Published: May 19, 2026
- Affected: fixed in 26.4.12; from 26.5.0, fixed in 26.6.2.
- Fixed in 26.6.2 (released May 19, 2026, the day of disclosure, the advisory names 26.4.12, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-4630](https://cve.now/CVE-2026-4630): Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference

- Severity: Medium 6.8
- Published: May 19, 2026
- Affected: fixed in 26.6.2.
- Fixed in 26.6.2 (released May 19, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-8922](https://cve.now/CVE-2026-8922): Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

- Severity: Medium 5.4
- Published: May 19, 2026
- Affected: through 26.6.2.
- Fixed in 26.6.3 (released Jun 4, 2026, 16 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-8830](https://cve.now/CVE-2026-8830): Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript…

- Severity: Medium 4.3
- Published: May 19, 2026
- Affected: fixed in 26.6.3.
- Fixed in 26.6.3 (released Jun 4, 2026, 16 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-7500](https://cve.now/CVE-2026-7500): Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled

- Severity: Medium 5.4
- Published: Apr 30, 2026
- Affected: through 26.6.1.
- Fixed in 26.6.2 (released May 19, 2026, 19 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-37980](https://cve.now/CVE-2026-37980): Org.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page

- Severity: Medium 6.9
- Published: Apr 14, 2026
- Affected: through 26.5.5.
- Fixed in 26.5.6 (released Mar 19, 2026, 26 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-37977](https://cve.now/CVE-2026-37977): Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp…

- Severity: Low 3.7
- Published: Apr 6, 2026
- Affected: fixed in 26.4.13; from 26.5.0, fixed in 26.6.3.
- Fixed in 26.6.3 (released Jun 4, 2026, 59 days after disclosure, the advisory names 26.4.13, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-4636](https://cve.now/CVE-2026-4636): Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

- Severity: High 8.1
- Published: Apr 2, 2026
- Affected: fixed in 26.5.7.
- Fixed in 26.5.7 (released Apr 2, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-4634](https://cve.now/CVE-2026-4634): Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

- Severity: High 7.5
- Published: Apr 2, 2026
- Affected: fixed in 26.5.7.
- Fixed in 26.5.7 (released Apr 2, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-4325](https://cve.now/CVE-2026-4325): Keycloak: keycloak: replay of action tokens via improper handling of single-use entries

- Severity: Medium 5.3
- Published: Apr 2, 2026
- Affected: fixed in 26.5.7.
- Fixed in 26.5.7 (released Apr 2, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-4282](https://cve.now/CVE-2026-4282): Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

- Severity: High 7.4
- Published: Apr 2, 2026
- Affected: fixed in 26.5.7.
- Fixed in 26.5.7 (released Apr 2, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-3872](https://cve.now/CVE-2026-3872): Keycloak: keycloak: information disclosure due to redirect\_uri validation bypass

- Severity: High 7.3
- Published: Apr 2, 2026
- Affected: fixed in 26.5.7.
- Fixed in 26.5.7 (released Apr 2, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-3121](https://cve.now/CVE-2026-3121): Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

- Severity: Medium 6.5
- Published: Mar 26, 2026
- Affected: fixed in 26.5.6.
- Fixed in 26.5.6 (released Mar 19, 2026, 7 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-3190](https://cve.now/CVE-2026-3190): Keycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api

- Severity: Medium 4.3
- Published: Mar 26, 2026
- Affected: fixed in 26.5.6.
- Fixed in 26.5.6 (released Mar 19, 2026, 7 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-4874](https://cve.now/CVE-2026-4874): Org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint…

- Severity: Low 3.1
- Published: Mar 26, 2026
- Affected: from 26.5.0, fixed in 26.6.3; fixed in 26.4.13.
- Fixed in 26.6.3 (released Jun 4, 2026, 70 days after disclosure, the advisory names 26.4.13, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-4633](https://cve.now/CVE-2026-4633): Keycloak: keycloak: user enumeration via differential error messages

- Severity: Low 3.7
- Published: Mar 23, 2026
- Affected: from 26.5.0, fixed in 26.6.1; fixed in 26.4.12.
- Fixed in 26.6.1 (released Apr 15, 2026, 23 days after disclosure, the advisory names 26.4.12, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-4628](https://cve.now/CVE-2026-4628): Keycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control

- Severity: Medium 4.3
- Published: Mar 23, 2026
- Affected: through 26.6.0.
- Fixed in 26.6.1 (released Apr 15, 2026, 23 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-2575](https://cve.now/CVE-2026-2575): Keycloak: keycloak: denial of service due to excessive samlrequest decompression

- Severity: Medium 5.3
- Published: Mar 18, 2026
- Affected: fixed in 26.5.4.
- Fixed in 26.5.4 (released Feb 20, 2026, 26 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-2603](https://cve.now/CVE-2026-2603): Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

- Severity: High 8.1
- Published: Mar 18, 2026
- Affected: fixed in 26.5.5.
- Fixed in 26.5.5 (released Mar 5, 2026, 13 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-2092](https://cve.now/CVE-2026-2092): Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

- Severity: High 7.7
- Published: Mar 18, 2026
- Affected: through 26.2.5; from 26.3.0, through 26.4.7; from 26.5.0.
- No fix released. The latest release, 26.8.2, is still affected.

### [CVE-2026-3429](https://cve.now/CVE-2026-3429): Org.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api

- Severity: Medium 4.2
- Published: Mar 11, 2026
- Affected: through 26.5.6.
- Fixed in 26.5.7 (released Apr 2, 2026, 22 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-3911](https://cve.now/CVE-2026-3911): Org.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint

- Severity: Low 2.7
- Published: Mar 11, 2026
- Affected: through 26.5.5.
- Fixed in 26.5.6 (released Mar 19, 2026, 8 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-3009](https://cve.now/CVE-2026-3009): Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

- Severity: High 8.1
- Published: Mar 5, 2026
- Affected: fixed in 26.5.5.
- Fixed in 26.5.5 (released Mar 5, 2026, the day of disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-12150](https://cve.now/CVE-2025-12150): Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

- Severity: Low 3.1
- Published: Feb 27, 2026
- Affected: fixed in 26.4.4.
- Fixed in 26.4.4 (released Nov 7, 2025, 112 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-2733](https://cve.now/CVE-2026-2733): Org.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol

- Severity: Low 3.8
- Published: Feb 19, 2026
- Affected: through 26.5.3.
- Fixed in 26.5.4 (released Feb 20, 2026, 1 day after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-14778](https://cve.now/CVE-2025-14778): Keycloak: incorrect ownership checks in /uma-policy/

- Severity: Medium 5.4
- Published: Feb 9, 2026
- Affected: fixed in 26.2.13; from 26.5.0, fixed in 26.5.3; from 26.3.0, fixed in 26.4.9.
- Fixed in 26.5.3 (released Feb 10, 2026, 1 day after disclosure, the advisory names 26.2.13, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-1529](https://cve.now/CVE-2026-1529): Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation

- Severity: High 8.1
- Published: Feb 9, 2026
- Affected: from 26.5.0, fixed in 26.5.3; fixed in 26.2.13; from 26.3.0, fixed in 26.4.9.
- Fixed in 26.5.3 (released Feb 10, 2026, 1 day after disclosure, the advisory names 26.2.13, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-1486](https://cve.now/CVE-2026-1486): Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant

- Severity: High 8.8
- Published: Feb 9, 2026
- Affected: from 26.5.0, fixed in 26.5.3; fixed in 26.4.9.
- Fixed in 26.5.3 (released Feb 10, 2026, 1 day after disclosure, the advisory names 26.4.9, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-13881](https://cve.now/CVE-2025-13881): Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api

- Severity: Low 2.7
- Published: Feb 2, 2026
- Affected: from 26.5.0, fixed in 26.5.2; fixed in 26.4.9.
- Fixed in 26.5.2 (released Jan 23, 2026, 10 days before disclosure, the advisory names 26.4.9, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-1190](https://cve.now/CVE-2026-1190): Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata

- Severity: Low 3.1
- Published: Jan 26, 2026
- Affected: through 26.5.2.
- Fixed in 26.5.3 (released Feb 10, 2026, 15 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-14083](https://cve.now/CVE-2025-14083): Keycloak-server: keycloak: improper access control in admin rest api leads to information disclosure

- Severity: Low 2.7
- Published: Jan 21, 2026
- Affected: through 26.2.5.
- Fixed in 26.3.0 (released Jul 1, 2025, 204 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-14559](https://cve.now/CVE-2025-14559): Org.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users

- Severity: Medium 6.5
- Published: Jan 21, 2026
- Affected: from 26.5.0, fixed in 26.5.2; fixed in 26.4.9.
- Fixed in 26.5.2 (released Jan 23, 2026, 2 days after disclosure, the advisory names 26.4.9, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2026-1035](https://cve.now/CVE-2026-1035): Org.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition

- Severity: Low 3.1
- Published: Jan 21, 2026
- Affected: through 26.2.5.
- Fixed in 26.3.0 (released Jul 1, 2025, 204 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-14082](https://cve.now/CVE-2025-14082): Keycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure

- Severity: Low 2.7
- Published: Dec 10, 2025
- Affected: fixed in 26.5.0.
- Fixed in 26.5.0 (released Jan 6, 2026, 27 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-12390](https://cve.now/CVE-2025-12390): Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id

- Severity: Medium 6.0
- Published: Oct 28, 2025
- Affected: fixed in 26.0.0.
- Fixed in 26.0.0 (released Oct 4, 2024, 389 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-12110](https://cve.now/CVE-2025-12110): Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline\_access scope was removed

- Severity: Medium 5.4
- Published: Oct 23, 2025
- Affected: fixed in 26.2.3.
- Fixed in 26.2.3 (released May 5, 2025, 171 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-11429](https://cve.now/CVE-2025-11429): Keycloak-server: too long and not settings compliant session

- Severity: Medium 5.4
- Published: Oct 23, 2025
- Affected: from 26.3.0, fixed in 26.4.1; fixed in 26.2.11.
- Fixed in 26.4.1 (released Oct 16, 2025, 7 days before disclosure, the advisory names 26.2.11, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-8419](https://cve.now/CVE-2025-8419): Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

- Severity: Medium 5.3
- Published: Aug 6, 2025
- Affected: fixed in 26.2.8; from 26.3.0, fixed in 26.3.3.
- Fixed in 26.3.3 (released Aug 20, 2025, 14 days after disclosure, the advisory names 26.2.8, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-7784](https://cve.now/CVE-2025-7784): Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)

- Severity: Medium 6.5
- Published: Jul 18, 2025
- Affected: from 26.2.0, fixed in 26.2.6.
- Fixed in 26.3.0 (released Jul 1, 2025, 17 days before disclosure, the advisory names 26.2.6, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-7365](https://cve.now/CVE-2025-7365): Keycloak: phishing attack via email verification step in first login flow

- Severity: High 7.1
- Published: Jul 10, 2025
- Affected: fixed in 26.0.13; from 26.2.0, fixed in 26.2.6.
- Fixed in 26.1.0 (released Jan 15, 2025, 176 days before disclosure, the advisory names 26.0.13, which was never published) and 26.3.0 (released Jul 1, 2025, 9 days before disclosure, the advisory names 26.2.6, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-3910](https://cve.now/CVE-2025-3910): Org.keycloak.authentication: two factor authentication bypass

- Severity: Medium 5.4
- Published: Apr 29, 2025
- Affected: fixed in 26.2.2.
- Fixed in 26.2.2 (released Apr 30, 2025, 1 day after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-3501](https://cve.now/CVE-2025-3501): Org.keycloak.protocol.services: keycloak hostname verification

- Severity: High 8.2
- Published: Apr 29, 2025
- Affected: fixed in 26.2.2.
- Fixed in 26.2.2 (released Apr 30, 2025, 1 day after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-2559](https://cve.now/CVE-2025-2559): Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak

- Severity: Medium 4.9
- Published: Mar 25, 2025
- Affected: through 26.1.4.
- Fixed in 26.1.5 (released Apr 11, 2025, 17 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2025-1391](https://cve.now/CVE-2025-1391): Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims

- Severity: Medium 5.4
- Published: Feb 17, 2025
- Affected: from 26.1.0, fixed in 26.1.3; fixed in 26.0.10.
- Fixed in 26.1.3 (released Feb 28, 2025, 11 days after disclosure, the advisory names 26.0.10, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2024-10270](https://cve.now/CVE-2024-10270): Org.keycloak:keycloak-services: keycloak denial of service

- Severity: Medium 6.5
- Published: Nov 25, 2024
- Affected: fixed in 24.0.9; from 25.0.0, fixed in 26.0.6.
- Fixed in 26.0.6 (released Nov 22, 2024, 3 days before disclosure, the advisory names 24.0.9, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-0657](https://cve.now/CVE-2023-0657): Keycloak: impersonation via logout token exchange

- Severity: Low 3.4
- Published: Nov 17, 2024
- Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.
- Fixed in 24.0.3 (released Apr 16, 2024, 215 days before disclosure, the advisory names 22.0.10, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2022-2232](https://cve.now/CVE-2022-2232): Keycloak: ldap injection on username input

- Severity: High 7.5
- Published: Nov 14, 2024
- Affected: fixed in 23.0.1.
- Fixed in 23.0.1 (released Nov 29, 2023, 351 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2024-3656](https://cve.now/CVE-2024-3656): Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

- Severity: High 8.1
- Published: Oct 9, 2024
- Affected: fixed in 24.0.5.
- Fixed in 24.0.5 (released Jun 4, 2024, 127 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2024-8883](https://cve.now/CVE-2024-8883): Keycloak: vulnerable redirect uri validation results in open redirec

- Severity: Medium 6.1
- Published: Sep 19, 2024
- Affected: fixed in 22.0.13; from 23.0.0, fixed in 24.0.8; from 25.0.0, fixed in 25.0.6.
- Fixed in 25.0.6 (released Sep 19, 2024, the day of disclosure, the advisory names 22.0.13, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2024-7341](https://cve.now/CVE-2024-7341): Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

- Severity: High 7.1
- Published: Sep 9, 2024
- Affected: fixed in 22.0.12; from 23.0.0, fixed in 24.0.7; from 25.0.0, fixed in 25.0.5.
- Fixed in 25.0.5 (released Sep 10, 2024, 1 day after disclosure, the advisory names 22.0.12, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2024-4629](https://cve.now/CVE-2024-4629): Keycloak: potential bypass of brute force protection

- Severity: Medium 6.5
- Published: Sep 3, 2024
- Affected: fixed in 22.0.12; from 23.0.0, fixed in 24.0.7; from 25.0.0, fixed in 25.0.4.
- Fixed in 25.0.4 (released Aug 19, 2024, 15 days before disclosure, the advisory names 22.0.12, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2024-4540](https://cve.now/CVE-2024-4540): Keycloak: exposure of sensitive information in pushed authorization requests (par) kc\_restart cookie

- Severity: High 7.5
- Published: Jun 3, 2024
- Affected: fixed in 24.0.5.
- Fixed in 24.0.5 (released Jun 4, 2024, 1 day after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-6787](https://cve.now/CVE-2023-6787): Keycloak: session hijacking via re-authentication

- Severity: Medium 6.5
- Published: Apr 25, 2024
- Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.
- Fixed in 24.0.3 (released Apr 16, 2024, 9 days before disclosure, the advisory names 22.0.10, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-6717](https://cve.now/CVE-2023-6717): Keycloak: xss via assertion consumer service url in saml post-binding flow

- Severity: Medium 6.0
- Published: Apr 25, 2024
- Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.
- Fixed in 24.0.3 (released Apr 16, 2024, 9 days before disclosure, the advisory names 22.0.10, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-6544](https://cve.now/CVE-2023-6544): Keycloak: authorization bypass

- Severity: Medium 5.4
- Published: Apr 25, 2024
- Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.
- Fixed in 24.0.3 (released Apr 16, 2024, 9 days before disclosure, the advisory names 22.0.10, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-6484](https://cve.now/CVE-2023-6484): Keycloak: log injection during webauthn authentication or registration

- Severity: Medium 5.3
- Published: Apr 25, 2024
- Affected: fixed in 22.0.9; from 23.0.0, fixed in 23.0.5.
- Fixed in 23.0.5 (released Jan 29, 2024, 87 days before disclosure, the advisory names 22.0.9, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-3597](https://cve.now/CVE-2023-3597): Keycloak: secondary factor bypass in step-up authentication

- Severity: Medium 5.0
- Published: Apr 25, 2024
- Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.
- Fixed in 24.0.3 (released Apr 16, 2024, 9 days before disclosure, the advisory names 22.0.10, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2024-2419](https://cve.now/CVE-2024-2419): Keycloak: path traversal in the redirect validation

- Severity: High 7.1
- Published: Apr 17, 2024
- Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.
- Fixed in 24.0.3 (released Apr 16, 2024, 1 day before disclosure, the advisory names 22.0.10, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2024-1249](https://cve.now/CVE-2024-1249): Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos

- Severity: High 7.4
- Published: Apr 17, 2024
- Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.
- Fixed in 24.0.3 (released Apr 16, 2024, 1 day before disclosure, the advisory names 22.0.10, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2024-1132](https://cve.now/CVE-2024-1132): Keycloak: path transversal in redirection validation

- Severity: High 8.1
- Published: Apr 17, 2024
- Affected: fixed in 22.0.10; from 23.0.0, fixed in 24.0.3.
- Fixed in 24.0.3 (released Apr 16, 2024, 1 day before disclosure, the advisory names 22.0.10, which was never published).
- The latest release, 26.8.2, is not affected.

### [CVE-2024-1722](https://cve.now/CVE-2024-1722): Keycloak-core: dos via account lockout

- Severity: Low 3.7
- Published: Feb 27, 2024
- Affected: fixed in 24.0.0.
- Fixed in 24.0.0 (released Mar 4, 2024, 6 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-6291](https://cve.now/CVE-2023-6291): Keycloak: redirect\_uri validation bypass

- Severity: High 7.1
- Published: Jan 26, 2024
- Affected: fixed in 23.0.3.
- Fixed in 23.0.3 (released Dec 15, 2023, 42 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-2585](https://cve.now/CVE-2023-2585): Keycloak: client access via device auth request spoof

- Severity: Low 3.5
- Published: Dec 21, 2023
- Affected: fixed in 21.1.2.
- Fixed in 21.1.2 (released Jun 28, 2023, 176 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-6134](https://cve.now/CVE-2023-6134): Keycloak: reflected xss via wildcard in oidc redirect\_uri

- Severity: Medium 4.6
- Published: Dec 14, 2023
- Affected: fixed in 23.0.3.
- Fixed in 23.0.3 (released Dec 15, 2023, 1 day after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-2422](https://cve.now/CVE-2023-2422): Keycloak: oauth client impersonation

- Severity: Medium 5.5
- Published: Oct 4, 2023
- Affected: fixed in 21.1.2.
- Fixed in 21.1.2 (released Jun 28, 2023, 98 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2022-1438](https://cve.now/CVE-2022-1438): Keycloak: xss on impersonation under specific circumstances

- Severity: Medium 6.4
- Published: Sep 20, 2023
- Affected: through 21.0.0.
- Fixed in 21.0.1 (released Mar 1, 2023, 203 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 26.8.2, is not affected.

### [CVE-2023-0264](https://cve.now/CVE-2023-0264): A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests.

- Severity: Unrated
- Published: Aug 4, 2023
- Affected: fixed in 21.0.1.
- Fixed in 21.0.1 (released Mar 1, 2023, 156 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2022-4361](https://cve.now/CVE-2022-4361): Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC…

- Severity: Critical 10.0
- Published: Jul 7, 2023
- Affected: fixed in 21.1.2.
- Fixed in 21.1.2 (released Jun 28, 2023, 9 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2022-1274](https://cve.now/CVE-2022-1274): A flaw was found in Keycloak in the execute-actions-email endpoint.

- Severity: Unrated
- Published: Mar 29, 2023
- Affected: fixed in 20.0.5.
- Fixed in 20.0.5 (released Feb 21, 2023, 36 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2021-3754](https://cve.now/CVE-2021-3754): A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user.

- Severity: Unrated
- Published: Aug 26, 2022
- Affected: fixed in 24.0.1.
- Fixed in 24.0.1 (released Mar 5, 2024, 557 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2022-1245](https://cve.now/CVE-2022-1245): A privilege escalation flaw was found in the token exchange feature of keycloak.

- Severity: Unrated
- Published: Jul 7, 2022
- Affected: fixed in 18.0.0.
- Fixed in 18.0.0 (released Apr 20, 2022, 78 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2021-4133](https://cve.now/CVE-2021-4133): A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create…

- Severity: Unrated
- Published: Jan 25, 2022
- Affected: fixed in 15.1.1.
- Fixed in 15.1.1 (released Dec 17, 2021, 39 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2021-3424](https://cve.now/CVE-2021-3424): A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible.

- Severity: Unrated
- Published: Jun 1, 2021
- Affected: fixed in 18.0.0.
- Fixed in 18.0.0 (released Apr 20, 2022, 323 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2020-10776](https://cve.now/CVE-2020-10776): A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect\_uri parameter.

- Severity: Unrated
- Published: Nov 17, 2020
- Affected: fixed in 12.0.0.
- Fixed in 12.0.0 (released Dec 16, 2020, 29 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2014-3652](https://cve.now/CVE-2014-3652): JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.

- Severity: Unrated
- Published: Dec 15, 2019
- Affected: fixed in 1.1.0.Beta1.
- Fixed in 1.1.0.Beta1 (released Nov 4, 2014, 1867 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2014-3655](https://cve.now/CVE-2014-3655): JBoss KeyCloak is vulnerable to soft token deletion via CSRF

- Severity: Unrated
- Published: Nov 13, 2019
- Affected: fixed in 1.0.2.Final.
- Fixed in 1.0.2.Final (released Oct 8, 2014, 1862 days before disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2018-10894](https://cve.now/CVE-2018-10894): It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates.

- Severity: Medium 5.4
- Published: Aug 1, 2018
- Affected: fixed in 4.4.0.Final.
- Fixed in 4.4.0.Final (released Sep 5, 2018, 35 days after disclosure).
- The latest release, 26.8.2, is not affected.

### [CVE-2014-3709](https://cve.now/CVE-2014-3709): The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct…

- Severity: Unrated
- Published: Oct 18, 2017
- Affected: fixed in 1.0.3.Final.
- Fixed in 1.0.3.Final (released Oct 28, 2014, 1086 days before disclosure).
- The latest release, 26.8.2, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.keycloak:keycloak-services
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.