Priority LOW 38
A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00459 · Published 2026-08-05 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551
Priority LOW 38
A flaw was found in Keycloak's Authorization Services.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00459 · Published 2026-08-05 · Partial fix · 26.4.14-1, 26.4-22 +2 CWE-551
Priority LOW 25
Keycloak provides a mechanism called Client Policies to enforce security requirements on clients, such as requiring them to use signed JWTs for authentication.
CVSS 3.1MEDIUM 5.4· Network · Low privileges · No interaction · EPSS 0.00393 · Published 2026-07-17 · Partial fix · 26.6.7-3, 26.6-20 CWE-807
Priority LOW 20
A flaw was found in the group search functionality of the Keycloak server's administrative API.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00348 · Published 2026-07-16 · Partial fix · 26.6.7-3, 26.6-20 CWE-639
Priority LOW 38
A further incomplete fix for a previous advisory CVE-2026-44417 (Untrusted JMS configuration can lead to RCE) for Apache CXF has been identified, which can allow code execution capabilities, if untrusted users are allowe…
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00697 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-20
Priority MEDIUM 43
Apache CXF's EndpointReferenceUtils and W3CMultiSchemaFactory classes construct a SAXParserFactory without the necessary JAXP hardening configurations, enabling out-of-band (OOB) external entity resolution.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00533 · Published 2026-06-12 · Partial fix · 4.2.2, 4.1.7 +1 CWE-611
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00689 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 42
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00719 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority MEDIUM 43
A flaw was found in Undertow.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00732 · Published 2026-03-27 · Partial fix · 2.3.24.SP2-redhat-00001, 2.40.0-7.redhat_00015.1.el8eap +9 CWE-444
Priority LOW 34
A flaw was found in Keycloak.
CVSS 3.1HIGH 7.2· Network · High privileges · No interaction · EPSS 0.00479 · Published 2026-03-26 · Partial fix · 26.4.11-1, 26.4-14 +1 CWE-266
Priority LOW 15
A flaw was found in Keycloak.
CVSS 3.1LOW 3.1· Network · Low privileges · No interaction · EPSS 0.00353 · Published 2026-03-26 · Partial fix · 26.4.13-1, 26.4-19 +4 CWE-918
Priority LOW 32
A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests.
CVSS 3.1MEDIUM 5.8· Network · No auth · No interaction · EPSS 0.00242 · Published 2026-03-18 · Partial fix · 26.4.12-1, 26.4-17 CWE-918
Priority LOW 37
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.0038 · Published 2026-03-05 · Partial fix · 26.4.10-1, 26.4-12 +1 CWE-863
Priority HIGH 76
A flaw was found in the Undertow HTTP server core, which is used in WildFly, JBoss EAP, and other Java applications.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.01333 · Published 2026-01-07 · Partial fix · 1.4.18-21.SP19_redhat_00001.1.ep7.el7, 2.0.41-8.SP9_redhat_00001.1.el7eap +50 CWE-20
Priority MEDIUM 43
A flaw was found in Undertow where malformed client requests can trigger server-side stream resets without triggering abuse counters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02325 · Published 2025-09-02 · Partial fix · 2.2.38.Final, 1.4.18-21.SP19_redhat_00001.1.ep7.el7 +50 CWE-770
Priority LOW 28
A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by omitting the tag ending in a less-than characte…
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00493 · Published 2024-11-07 · Partial fix · 6.2.0.Final CWE-79
Priority LOW 33
A misconfiguration flaw was found in Keycloak.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.02112 · Published 2024-09-19 · Fixed in 22.0.12, 24.0.7 +87 CWE-601
Priority MEDIUM 40
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send b…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00736 · Published 2024-09-10 · Partial fix · 24.0.0 CWE-231
Priority LOW 35
A session fixation issue was discovered in the SAML adapters provided by Keycloak.
CVSS 3.1HIGH 7.1· Network · Low privileges · User interaction · EPSS 0.00848 · Published 2024-09-09 · Fixed in 22.0.12, 24.0.7 +10 CWE-384
Priority LOW 36
A vulnerability was found in Keycloak.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.00793 · Published 2024-09-03 · Fixed in 22.0.12-1, 22-17 +8 CWE-837
Priority LOW 38
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02644 · Published 2024-08-21 · Partial fix · 2.2.36.Final, 2.3.17.Final +27 CWE-362
Priority HIGH 70
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.01552 · Published 2024-04-17 · Partial fix · 22.0.10, 24.0.3 +12 CWE-22
Priority MEDIUM 40
A vulnerability was found in Undertow.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.04572 · Published 2024-02-19 · Partial fix · 1.5.5.016-1.redhat_00001.1.ep7.el7, 1:1.5.5.016-1.redhat_00001.1.ep7.el7 +24 CWE-400
Priority LOW 33
A flaw was found in the redirect_uri validation logic in Keycloak.
CVSS 3.1HIGH 7.1· Network · No auth · User interaction · EPSS 0.0095 · Published 2024-01-26 · Partial fix · 22.0.7-1, 22-6 +11 CWE-601
Priority LOW 36
Keycloak's device authorization grant does not correctly validate the device code and client ID.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00694 · Published 2023-12-21 · Fixed in 18.0.8-1.redhat_00001.1.el7sso, 18.0.8-1.redhat_00001.1.el8sso +3 CWE-358
Load more
THREATIST.IORead the docs