Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization due to the full-scope-disabled client-policy executor. An attacker can create a client...

Missing Authorization

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the user creation path in UsersResource.create and...

Incorrect Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Authorization due to claim handling in the UMA claim-token evaluation path. An attacker can access...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization during client update handling. An attacker can persist a confidential client that does...

CLEANSTART-2026-SU06112 Security fixes in keycloak 26.6.3-r3

Package keycloak version 26.6.3-r3 fixes 13 vulnerabilities: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516...

CLEANSTART-2026-QW10501 Security fixes in keycloak 26.4.10-r0

Package keycloak version 26.4.10-r0 fixes 26 vulnerabilities: CVE-2026-42579, CVE-2026-42587, CVE-2026-42583, CVE-2026-42584, CVE-2026-33871...

CLEANSTART-2026-WW01909 Security fixes in keycloak 26.3.5-r3

Package keycloak version 26.3.5-r3 fixes 24 vulnerabilities: CVE-2026-42583, CVE-2026-42579, CVE-2026-44893, CVE-2026-48059, CVE-2026-33870...

CLEANSTART-2026-QU85101 Security fixes in keycloak 26.4.11-r0

Package keycloak version 26.4.11-r0 fixes 4 vulnerabilities: CVE-2026-1002, CVE-2026-33871, ghsa-cphf-4846-3xx9, ghsa-w9fj-cfpg-grvv...

CLEANSTART-2026-LC38113 Security fixes in keycloak 26.4.7-r5

Package keycloak version 26.4.7-r5 fixes 5 vulnerabilities: CVE-2026-57914, CVE-2026-9563, CVE-2025-11965, CVE-2025-11966, CVE-2026-45536...

CLEANSTART-2026-JZ16335 Security fixes in keycloak 26.6.4-r2

Package keycloak version 26.6.4-r2 fixes 4 vulnerabilities: ghsa-r7wm-3cxj-wff9, CVE-2026-55851, CVE-2026-59919, CVE-2026-55831...

CLEANSTART-2026-TO43731 Security fixes in keycloak 26.4.7-r7

Package keycloak version 26.4.7-r7 fixes 2 vulnerabilities: CVE-2026-40984, CVE-2026-50559...

CLEANSTART-2026-HT07249 Security fixes in keycloak 26.5.7-r0

Package keycloak version 26.5.7-r0 fixes 34 vulnerabilities: CVE-2025-11965, CVE-2025-11966, CVE-2025-59250, CVE-2026-0636, CVE-2026-5588...

CLEANSTART-2026-BA48144 Security fixes in keycloak 26.5.7-r5

Package keycloak version 26.5.7-r5 fixes 11 vulnerabilities: CVE-2026-54291, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515...

CLEANSTART-2026-SH90347 Security fixes in keycloak 26.6.1-r3

Package keycloak version 26.6.1-r3 fixes 8 vulnerabilities: ghsa-3qp7-7mw8-wx86, ghsa-x4gw-5cx5-pgmh, ghsa-5x3r-wrvg-rp6q, ghsa-c2gf-v879-257j, CVE-2026-47244...

CLEANSTART-2026-YX95586 Security fixes in keycloak 26.5.0-r1

Package keycloak version 26.5.0-r1 fixes 6 vulnerabilities: ghsa-h5fg-jpgr-rv9c, ghsa-45p5-v273-3qqr, CVE-2017-12159, CVE-2017-12158, ghsa-5rfx-cp42-p624...

CLEANSTART-2026-KH48438 Security fixes in keycloak 26.5.7-r1

Package keycloak version 26.5.7-r1 fixes 24 vulnerabilities: CVE-2026-44893, CVE-2026-44249, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673...

CLEANSTART-2026-AU26255 Security fixes in keycloak 26.2.12-r0

Package keycloak version 26.2.12-r0 fixes 7 vulnerabilities: ghsa-3p8m-j85q-pgmj, ghsa-fghv-69vj-qj49, ghsa-h5fg-jpgr-rv9c, ghsa-45p5-v273-3qqr, ghsa-j288-q9x7-2f5v...

PT-2026-85820

Package keycloak version 26.2.12-r0 fixes 7 vulnerabilities: ghsa-3p8m-j85q-pgmj, ghsa-fghv-69vj-qj49, ghsa-h5fg-jpgr-rv9c, ghsa-45p5-v273-3qqr, ghsa-j288-q9x7-2f5v...

CVE-2026-18207

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a...