Keycloak 代码问题漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak itself. Keycloak has code-related vulnerabilities; these vulnerabilities stem from insufficient backend notification endpoint validation by the CIBA function regarding client configurations. This may lead to...

Keycloak < 26.4.4 Debug Mode JDWP Port Exposure (CVE-2025-11538)

The version of Keycloak installed on the remote host is prior to 26.4.4. It is, therefore, affected by a Port Exposure vulnerability: - A vulnerability exists in Keycloak's server distribution where enabling debug mode --debug insecurely defaults to binding the Java Debug Wire Protocol JDWP port ...

PT-2026-5623

A flaw was found in Keycloak’s CIBA feature where insufficient validation of client-configured backchannel notification endpoints could allow blind server-side requests to internal services...

Keycloak x < 26.4.9 / 26.5.x < 26.5.2 Token Exchange Vulnerability

The version of Keycloak installed on the remote host is prior to 26.4.9 / 26.5.2 / 26.6.0. It is, therefore, affected by the following Token Exchange vulnerability: - A flaw was found in the keycloak-services component of Keycloak. This vulnerability allows the issuance of access and refresh toke...

CLEANSTART-2026-SG80587 It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session

Multiple security vulnerabilities affect the keycloak package. It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. See references for individual vulnerability details...

PT-2026-5499

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Keycloak Admin API that allows an administrator with limited privileges to retrieve sensitive custom attributes. This is achieved through the /unmanagedAttributes API...

GHSA-WV3H-X6C4-R867 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2025-14559 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2025-66021 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-G9GQ-3PFX-2GW2 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-G9GQ-3PFX-2GW2 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2025-66021 vulnerabilities

Vulnerabilities for packages: keycloak...

Incorrect Privilege Assignment

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Privilege Assignment via the Admin API. An attacker can access sensitive user attributes ...

Keycloak security vulnerabilities

Keycloak is an open-source identity and access management solution developed by Keycloak. There is a security vulnerability in Keycloak, which stems from improper control of administrator API permissions. This vulnerability may allow restricted administrators to retrieve sensitive user attributes...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.charlyghislain.keycloak:keycloak-importexport (>=21.0.0 <=23.0.1) +155 more potentially affected by CVE-2026-1190 via org.keycloak:keycloak-services (>=1.0-alpha-1 <=26.5.2)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =21.0.0, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.2.0, =1.3.0 and more Source cves: CVE-2026-1190 Source advisory: OSV:GHSA-63V5-26VQ-M4VMhttps://vulners.com/osv/OSV:GHSA-63V5-26VQ-M4...

GHSA-63V5-26VQ-M4VM Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language SAML setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML...

Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language SAML setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML...

CVE-2026-1190

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language SAML setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML...

EUVD-2026-4670

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language SAML setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML...

CVE-2026-1190 Org.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language SAML setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML...