Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

22 records

Vendor: Keycloak Clear all filters
TI-2025-10573 CVE-2025-11538 · GHSA-j4vq-q93m-4683

Keycloak-server: debug default bind address

Priority LOW 32

A vulnerability exists in Keycloak's server distribution where enabling debug mode (--debug <port>) insecurely defaults to binding the Java Debug Wire Protocol (JDWP) port to all network interfaces (0.0.0.0).

CVSS 3.1MEDIUM 6.8 Adjacent network No auth No interaction EPSS 0.00425 Published 2025-11-13 Fixed in 26.4.4, 26.4.4-1 +1 CWE-1327
TI-2025-11106 CVE-2025-12110 · GHSA-895x-rfqp-jh5c

Insufficient session expiration in keycloak

Priority LOW 24

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00301 Published 2025-10-23 Fixed in 26.4.3, 26.2.11-1 +4 CWE-613
TI-2022-03994 CVE-2022-4361 · GHSA-3p62-6fjh-3p5h

Cross-site scripting in keycloak

Priority MEDIUM 50

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00691 Published 2023-07-07 Fixed in 21.1.2 CWE-81
TI-2020-08589 CVE-2020-10686 · GHSA-9695-w6h2-jpv9

Improper authorization in keycloak

Priority LOW 23

A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself.

CVSS 3.1MEDIUM 4.7 Network High privileges No interaction EPSS 0.00654 Published 2020-05-04 Fixed in 9.0.2 CWE-285
TI-2019-11025 CVE-2019-14820 · GHSA-xfqh-7356-vqjj

Information disclosure in keycloak

Priority LOW 21

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00717 Published 2020-01-08 Partial fix · 8.0.0 CWE-200
TI-2019-11037 CVE-2019-14832 · GHSA-8prc-58j4-m55q

Incorrect authorization in keycloak REST API

Priority LOW 34

A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.0054 Published 2019-10-15 Partial fix · 7.0.1 CWE-863
TI-2017-08952 CVE-2017-12161 · GHSA-959q-32g8-vvp7

Weak password recovery in Red Hat Keycloak

Priority MEDIUM 41

It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01308 Published 2018-02-21 Partial fix · 3.4.2.Final, 3.4.2 CWE-602
TI-2017-08950 CVE-2017-12159 · GHSA-7fmw-85qm-h22p

Insufficient session expiration in Red Hat keycloak

Priority LOW 38

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02711 Published 2017-10-26 Fixed in 3.4.0 CWE-613
TI-2017-08949 CVE-2017-12158 · GHSA-v38p-mqq3-m6v5

Cross-site scripting in Red Hat keycloak

Priority LOW 26

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01021 Published 2017-10-26 Partial fix · 3.4.0 CWE-444
TI-2014-03024 CVE-2014-3709 · GHSA-xr6q-qqx7-553g

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak…

Priority MEDIUM 40

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00816 Published 2017-10-18 Fixed in 1.0.3.Final CWE-352