CVE-2026-107121

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...

EUVD-2026-94213

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...

CVE-2026-107121

A flaw exists in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, the system fails to strictly enforce encrypted connections, allowing a downgrade to unencrypted communication if the encryption request is tampered with. An attacker cap...

CVE-2026-107121

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An...

KeyCloak - Information Exposure

A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients like client secret without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this...

Keycloak - SAML Core Package Signature Validation Flaw

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...

Keycloak 10.0.0 - 18.0.0 - Cross-Site Scripting

Keycloak 10.0.0 to 18.0.0 contains a cross-site scripting vulnerability via the client-registrations endpoint. On a POST request, the application does not sanitize an unknown attribute name before including it in the error response with a 'Content-Type' of text/hml. Once reflected, the response i...

Keycloak < 26.7.2 - Unauthenticated Account Takeover via Reset-Credentials Bypass

Keycloak versions prior to 26.7.2, 26.6.6, and 26.4.15 contain a flaw in the reset-credentials flow that allows an unauthenticated attacker to bypass email verification and take over any user account. Two bugs are chained: 1 the tryAnotherWay handler stores a generic "true" selector note not scop...

Keycloak - Open Redirect

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...

Keycloak < 24.0.5 - Broken Access Control

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. id: CVE-2024-3656 info...

keycloak

Gestión de identidad y acceso de código abierto Añade autenticación a aplicaciones y protege servicios con el mínimo esfuerzo. No necesitas ocuparte de almacenar usuarios ni de autenticarlos. Keycloak proporciona federación de usuarios, autenticación sólida, gestión de usuarios, autorización de...

Keycloak-12.0.1-CVE-2020-10770

Keycloak-12.0.1-CVE-2020-10770 Keycloak 12.0.1 - 'requesturi' Server-Side Request Forgery SSRF ciego Sin autenticación Exploit-DB-50405 Resultado esperado: Escaneo de puertos de localhost o hosts accesibles internamente. Destinado únicamente para fines educativos y pruebas en entornos corporativo...

Exploits

Exploits CVEs originales, PoCs de exploits y avisos de seguridad por @kmkz · boffsec-services.com · @kmkzsecurity 2026 Archivo| Objetivo| Tipo| CVSSv3 ---|---|---|--- CVE-2026-22191-SicuroWeb-ATI-chain.txt| SicuroWeb / Beghelli Sicuro24| Aviso cadena de 3 CVE| 9.3 CVE-2026-22191-POC.py| SicuroWeb...

kcmapper

KcMapper KcMapper es una herramienta para exportar los datos de configuración de Keycloak a una base de datos de grafos Neo4j. Esta representación permite analizar las relaciones entre realms, clientes, usuarios, grupos y roles. La herramienta incluye una interfaz web para ejecutar consultas Cyph...

CVE-2024-3656

Keycloak 24.0.5 is vulnerable to Broken Access Control vulnerability, where the attacker can use any authenticated user to perform some api action such as : Test LDAP connections via the testLDAPConnection endpoint. Retrieve unmanaged attributes of any user via the getUnmanagedAttributes endpoint...

CVE-2021-20323

CVE-2021-20323 Escáner de explotación de vulnerabilidad Cross Site Scripting en Keycloak...

CVE-2021-20323

CVE-2021-20323 Descripción Keycloak anterior a 18.0.0 y posterior a 10.0.0 contiene un XSS reflejado en el endpoint de registros de clientes. El error se desencadena al proporcionar, mediante POST, una estructura JSON con una clave como nombre de parámetro que no es compatible con el endpoint. La...

POC-CVE-2026-18963

CVE-2026-18963 — PoC de omisión de autenticación en el flujo de «Olvidé mi contraseña» de Keycloak Prueba de concepto para CVE-2026-18963 , una vulnerabilidad en el flujo de «Olvidé mi contraseña» / selección de credenciales de Keycloak que permite a un atacante alcanzar el paso UPDATEPASSWORD — ...

CVE-2026-18963-keycloak

CVE-2026-18963 — Keycloak Reset-Credentials Bypass → Account Takeover Unauthenticated account takeover in Keycloak's reset-credentials flow. An attacker who knows only a username/email can reset any user's password — including admins — without ever receiving the verification email. ⚠️ Disclaimer —...

keycloak: Keycloak: Denial of Service via specially crafted SAML input

A flaw was found in Keycloak. A remote, unauthenticated attacker can send a specially crafted XML input to the Security Assertion Markup Language SAML endpoint. This malicious input can cause high CPU usage and worker thread starvation, leading to a Denial of Service DoS where the server becomes...