org.keycloak:keycloak-saml-adapter-galleon-pack (>=21.1.0 <=26.5.3), org.keycloak:keycloak-saml-jakarta-servlet-filter-adapter (>=21.1.0 <=22.0.4) +28 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-saml-adapter-core (>=1.9.0.CR1 <=26.5.3)

org.keycloak:keycloak-saml-adapter-core MAVEN version =1.9.0.CR1, =21.1.0, =21.1.0, =1.9.0.CR1, =1.9.0.CR1, =1.9.0.CR1, =1.9.0.CR1, =1.9.0.CR1, =1.9.0.CR1, =20.0.0, =20.0.0, =1.9.0.CR1, =20.0.0, =1.9.0.CR1, =20.0.0, =1.9.0.CR1, =1.9.8.Final and more Source cves: CVE-2026-2575 Source advisory:...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (=24.3.0.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (=24.3.0.0) +65 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-saml-core (>=1.9.0.CR1 <=26.5.3)

org.keycloak:keycloak-saml-core MAVEN version =1.9.0.CR1, =2.5.6-24.0, =1.0.0-25.0, =0.1.0, =2.1, =8.1, =2.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.5.3 and more Source cves: CVE-2026-2575https://vulners.com/cve/CVE-20...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the SAMLRequest DEFLATE decompression. An attacker can cause service disruption by sending a highly compressed requests that trigger excessive resource consumption durin...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.keycloak:keycloak-saml-core is an Identity and Access Management plugin for Keycloak. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the SAMLRequest DEFLATE decompression. An attacker can cause service disruption...

PT-2026-8388

Name of the Vulnerable Software and Affected Versions Rocket TRUfusion Enterprise versions through 7.10.5 Description Rocket TRUfusion Enterprise through version 7.10.5 has a path traversal issue in the WsPortalV6UpDwAxis2Impl service, accessible via the API endpoint...

oidc-poc

OIDC SSO Proof of Concept Proof of concept for bidirectional...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8 <=3.1.14-jdk17) +192 more potentially affected by CVE-2026-2366 via org.keycloak:keycloak-services (>=10.0.0 <=26.5.5)

org.keycloak:keycloak-services MAVEN version =10.0.0, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.4.11 - com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak =24.3.0.0 -...

Keycloak Detection Consolidation

Consolidation of Keycloak detections. SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; if description...

Keycloak 安全漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability, which stems from an authorization bypass in the Admin API. This vulnerability may lead to information leakage...

GHSA-63V5-26VQ-M4VM vulnerabilities

Vulnerabilities for packages: keycloak, keycloak-fips...

CVE-2026-1190 vulnerabilities

Vulnerabilities for packages: keycloak, keycloak-fips...

Exploit for CVE-2026-1529

CVE-2026-1529 Keycloak Exploit Tool Keycloak: Unauthorized...

CVE-2026-1190 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-63V5-26VQ-M4VM vulnerabilities

Vulnerabilities for packages: keycloak...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0 <=5.5.1), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0) +26 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (>=12.0.0 <=26.5.5)

org.keycloak:keycloak-quarkus-server MAVEN version =12.0.0, =2.5.6-24.0, =0.1.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.2.0, =26.2.0, =26.5.5 and more Source cves:...

GHSA-GV3V-2CPP-3PMQ Keycloak logs sensitive headers

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

Keycloak logs sensitive headers

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

CVE-2025-11537

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

CVE-2025-11537 Keycloak-server: sensitive headers shown in the http access logs

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

CVE-2025-11537

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...