Security
فارسی
All products

org.keycloak:keycloak-services

Maven · Package
104 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Keycloak has authentication bypass via jwt algorithm confusionCVE-2026-11800 · GHSA-J97H-3F8R-MRJR org.keycloak:keycloak-servicesRed Hat Build of Keycloak/rhbk/keycloak-rhel9 MavenRed Hat High Fix reported
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypassCVE-2026-9086 · GHSA-V3F7-2P4R-MWFW org.keycloak:keycloak-services Maven High Fix reported
Keycloak vulnerable to information disclosure through arbitrary filesystem path probingCVE-2026-9083 · GHSA-9JRW-8XF7-XQHQ org.keycloak:keycloak-services Maven Medium Fix reported
Keycloak allows unauthorized access to resources via uma permission ticket bypassCVE-2026-9799 · GHSA-W3P3-7CJG-VGFW org.keycloak:keycloak-services Maven Medium Fix reported
Keycloak vulnerable to authorization bypass via incorrect uri comparisonCVE-2026-9800 · GHSA-F5P5-6XMX-P252 org.keycloak:keycloak-policy-enforcerorg.keycloak:keycloak-services MavenRed Hat High Fix reported
Keycloak: Attacker can re-enable and take over disabled clients via registration access tokenCVE-2026-9705 · GHSA-R7RC-C989-86G6 org.keycloak:keycloak-services Maven Medium Fix reported
Keycloak: Unauthorized access via improper validation of encrypted SAML assertionsCVE-2026-2092 · GHSA-794G-X443-36F7 org.keycloak:keycloak-services Maven High Fix reported
Keycloak's identity-first login flow exposes user informationCVE-2026-4633 · GHSA-RHGQ-F8X5-J2JC org.keycloak:keycloak-servicesRed Hat Build of Keycloak/rhbk/keycloak-rhel9 MavenRed Hat Low Fix reported
Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login pageCVE-2026-37980 · GHSA-M32F-8VH9-2HH3 org.keycloak:keycloak-servicesRed Hat Build of Keycloak/rhbk/keycloak-rhel9 MavenRed Hat Medium No fix reported
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=falseCVE-2026-4628 · GHSA-4PGC-GFRR-WCMG org.keycloak:keycloak-servicesRed Hat Build of Keycloak/keycloak-services MavenRed Hat Medium No fix reported
Keycloak: Denial of Service due to excessive SAMLRequest decompressionCVE-2026-2575 · GHSA-XV6H-R36F-3GP5 org.keycloak:keycloak-saml-adapter-coreorg.keycloak:keycloak-saml-core Maven Medium Fix reported
Keycloak has an Authentication Bypass by Primary WeaknessCVE-2026-9798 · GHSA-Q6H7-XXP7-7429 org.keycloak:keycloak-services Maven Medium No fix reported
Keycloak has a Forced Browsing issueCVE-2026-7500 · GHSA-HM32-HFMW-RHVG org.keycloak:keycloak-services Maven Medium No fix reported
Keycloak vulnerable to session takeovers due to reuse of session identifiersCVE-2025-12390 · GHSA-RG35-5V25-MQVP org.keycloak:keycloak-services Maven Medium Fix reported
Keycloak has an Improper Verification of Cryptographic Signature issueCVE-2026-9793 · GHSA-P3V8-FM5P-V84H org.keycloak:keycloak-services Maven Medium No fix reported
Keycloak Services has Improper Validation of Consistency within InputCVE-2026-9689 · GHSA-WCVJ-VPVW-9RR5 org.keycloak:keycloak-services Maven Medium No fix reported
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulationCVE-2026-4874 · GHSA-22RM-WP4X-V5CX org.keycloak:keycloak-servicesRed Hat Build of Keycloak/rhbk/keycloak-operator-bundle MavenRed Hat Low Fix reported
Keycloak: Missing Check on Disabled Client for Docker Registry ProtocolCVE-2026-2733 · GHSA-FJF4-6F34-W64Q org.keycloak:keycloak-servicesRed Hat Build of Keycloak/rhbk/keycloak-operator-bundle MavenRed Hat Low No fix reported
Keycloak services allows the issuance of access and refresh tokens for disabled usersCVE-2025-14559 · GHSA-WV3H-X6C4-R867 org.keycloak:keycloak-services Maven Medium Fix reported
Keycloak does not invalidate sessions when "Remember Me" is disabledCVE-2025-11429 · GHSA-64W3-5Q9M-68XF org.keycloak:keycloak-services Maven Medium Fix reported