Keycloak

Products

Exploited and recent CVEs

• CVE-2026-90997 High 7.4 Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch 0.4%
• CVE-2026-1609 High 8.1 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users 0.6%
• CVE-2025-12150 Low 3.1 Org.keycloak/keycloak-services: webauthn attestation statement verification bypass 0.2%
• CVE-2025-13467 Medium 5.5 Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation 0.5%
• CVE-2025-11538 Medium 6.8 Keycloak-server: debug default bind address 0.4%
• CVE-2025-12390 Medium 6.0 Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id 0.1%
• CVE-2025-10939 Low 3.7 Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console 0.4%
• CVE-2025-12110 Medium 5.4 Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed 0.3%
• CVE-2025-11429 Medium 5.4 Keycloak-server: too long and not settings compliant session 0.2%
• CVE-2025-10044 Medium 4.3 Keycloak: keycloak error_description injection on error pages 0.3%
• CVE-2025-9162 Medium 4.9 Org.keycloak/keycloak-model-storage-service: variable injection into environment variables 0.5%
• CVE-2025-8419 Medium 5.3 Org.keycloak/keycloak-services: keycloak smtp inject vulnerability 0.6%
• CVE-2022-4361 Critical 10.0 Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malic 0.7%
• CVE-2020-10686 Medium 4.1 A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post 0.7%