GHSA-RX66-HJ7G-28H7 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-RHGQ-F8X5-J2JC vulnerabilities

Vulnerabilities for packages: keycloak-fips, request-9047-keycloak-fips, keycloak...

GHSA-HJ93-H7PG-FH6V vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-H4WV-G838-66G3 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

CVE-2026-4874 vulnerabilities

Vulnerabilities for packages: keycloak-fips...

CVE-2026-4636 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-4PGC-GFRR-WCMG vulnerabilities

Vulnerabilities for packages: keycloak-fips...

GHSA-CJM2-J6CM-6P6M vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-22RM-WP4X-V5CX vulnerabilities

Vulnerabilities for packages: keycloak-fips...

CVE-2026-4633 vulnerabilities

Vulnerabilities for packages: keycloak-fips, request-9047-keycloak-fips, keycloak...

CVE-2026-3872 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-F2HX-5FX3-HMCV vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

CVE-2026-4634 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.charlyghislain.keycloak:keycloak-importexport (>=21.0.0 <=23.0.1) +160 more potentially affected by CVE-2026-4282 via org.keycloak:keycloak-services (>=1.0-alpha-1 <=26.5.6)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =21.0.0, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.0.0, =1.2.0 and more Source cves: CVE-2026-4282 Source advisory: OSV:GHSA-HJ93-H7PG-FH6Vhttps://vulners.com/osv/OSV:GHSA-HJ93-H7PG-...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.charlyghislain.keycloak:keycloak-importexport (>=21.0.0 <=23.0.1) +160 more potentially affected by CVE-2026-4634 via org.keycloak:keycloak-services (>=1.0-alpha-1 <=26.5.6)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =21.0.0, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.0.0, =1.2.0 and more Source cves: CVE-2026-4634 Source advisory: OSV:GHSA-H4WV-G838-66G3https://vulners.com/osv/OSV:GHSA-H4WV-G838-...

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Behavior Order: Authorization Before Parsing and Canonicalization via the UMA Policy Resource user...

EUVD-2026-18210

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of consumed action tokens, such as password reset links. This...

GHSA-F2HX-5FX3-HMCV Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

A flaw was found in Keycloak. An authenticated user with the umaprotection role can bypass User-Managed Access UMA policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation request, even if the URL path specifies an attacker-owned...

GHSA-HJ93-H7PG-FH6V Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can lead to the creation of admin-capable access tokens,...

GHSA-H4WV-G838-66G3 Keycloak: Application-Level DoS via Scope Processing

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect OIDC token endpoint. This leads to high resource consumption and prolonged processing times, ultimate...