Red Hat Red Hat Build of Keycloak

• CVE-2024-3884 High 7.5 Undertow: outofmemory when parsing form data encoding with application/x-www-form-urlencoded 1.5%
• CVE-2025-8419 Medium 5.3 Org.keycloak/keycloak-services: keycloak smtp inject vulnerability 0.6%
• CVE-2025-5416 Low 2.7 Keycloak-core: keycloak environment information 0.3%
• CVE-2025-3910 Medium 5.4 Org.keycloak.authentication: two factor authentication bypass 0.4%
• CVE-2025-3501 High 8.2 Org.keycloak.protocol.services: keycloak hostname verification 0.5%
• CVE-2025-2559 Medium 4.9 Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak 0.7%
• CVE-2025-23368 High 8.1 Org.wildfly.core:wildfly-elytron-integration: wildfly elytron brute force attack via cli 0.9%
• CVE-2024-4028 Low 3.8 Keycloak-core: stored xss in keycloak when creating a items in admin console 0.3%
• CVE-2025-1391 Medium 5.4 Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims 0.5%
• CVE-2025-23367 Medium 6.5 Org.wildfly.core:wildfly-server: wildfly improper rbac permission 0.8%
• CVE-2025-0604 Medium 5.4 Keycloak-ldap-federation: authentication bypass due to missing ldap bind after password reset in keycloak 0.7%
• CVE-2024-11736 Medium 4.9 Org.keycloak:keycloak-quarkus-server: unrestricted admin use of system and environment variables 0.8%
• CVE-2024-11734 Medium 6.5 Org.keycloak:keycloak-quarkus-server: denial of service in keycloak server via security headers 0.9%
• CVE-2024-10973 Medium 5.7 Keycloak: cli option for encrypted jgroups ignored 0.3%
• CVE-2024-12397 High 7.4 Io.quarkus.http/quarkus-http-core: quarkus http cookie smuggling 0.9%
• CVE-2024-12369 Medium 4.2 Elytron-oidc-client: oidc authorization code injection 0.2%
• CVE-2024-9666 Medium 4.7 Org.keycloak/keycloak-quarkus-server: keycloak proxy header handling denial-of-service (dos) vulnerability 0.4%
• CVE-2024-3656 High 8.1 Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities 3.3%
• CVE-2024-8883 Medium 6.1 Keycloak: vulnerable redirect uri validation results in open redirec 2.1%
• CVE-2024-8698 High 7.7 Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak 2.0%
• CVE-2024-7341 High 7.1 Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters 0.8%
• CVE-2024-7318 Medium 4.8 Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity 0.4%
• CVE-2024-7260 Medium 6.1 Keycloak-core: open redirect on account page 0.6%
• CVE-2024-4629 Medium 6.5 Keycloak: potential bypass of brute force protection 0.8%
• CVE-2024-7885 High 7.5 Undertow: improper state management in proxy protocol parsing causes information leakage 2.6%
• CVE-2024-3653 Medium 5.3 Undertow: learningpushhandler can lead to remote memory dos attacks 1.9%
• CVE-2024-5971 High 7.5 Undertow: response write hangs in case of java 17 tlsv1.3 newsessionticket 2.9%
• CVE-2024-6162 High 7.5 Undertow: url-encoded request path information can be broken on ajp-listener 1.7%
• CVE-2024-5967 Low 2.7 Keycloak: leak of configured ldap bind credentials through the keycloak admin console 0.6%
• CVE-2024-4540 High 7.5 Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie 0.6%
• CVE-2024-1102 Medium 6.5 Jberet: jberet-core logging database credentials 0.8%
• CVE-2024-2700 High 7.0 Quarkus-core: leak of local configuration properties into quarkus applications 0.3%
• CVE-2024-1300 Medium 5.4 Io.vertx:vertx-core: memory leak when a tcp server is configured with tls and sni support 1.1%
• CVE-2024-1023 Medium 6.5 Io.vertx/vertx-core: memory leak due to the use of netty fastthreadlocal data structures in vertx 1.7%
• CVE-2023-5685 High 7.5 Xnio: stackoverflowexception when the chain of notifier states becomes problematically big 3.5%
• CVE-2024-1722 Low 3.7 Keycloak-core: dos via account lockout 0.8%
• CVE-2024-1635 High 7.5 Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol 4.6%
• CVE-2023-6563 High 7.7 Keycloak: offline session token dos 1.2%