6029 matches found
Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.6.3 Images Update
New images are available for Red Hat build of Keycloak 26.6.3 and Red Hat build of Keycloak 26.6.3 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...
Information Disclosure
Keycloak is vulnerable to Information Disclosure. The vulnerability is due to differing error responses in the SAML ECP endpoint, where specially crafted SOAP requests with varying client IDs can trigger distinct faultstring values. An unauthenticated attacker can use these responses to determine...
Denial Of Service
Keycloak is vulnerable to Denial of Service DoS. The vulnerability is due to improper handling of LDAP password policy responses, where a malformed response from a configured LDAP server can trigger an OutOfMemoryError during password authentication processing, causing the Keycloak JVM to termina...
CVE-2026-44249 vulnerabilities
Vulnerabilities for packages: opensearch-fips, apache-activemq-artemis, zipkin, management-api-for-apache-cassandra-5.0, kafbat-ui-fips, spark, hono, akhq, request-9047-keycloak-fips, seata, airbyte-server-fips, kserve-modelmesh, opensearch, apache-hop-fips, keycloak-fips, apache-hop, druid,...
CVE-2026-45416 vulnerabilities
Vulnerabilities for packages: opensearch-fips, apache-activemq-artemis, zipkin, management-api-for-apache-cassandra-5.0, kafbat-ui-fips, spark, hono, akhq, request-9047-keycloak-fips, seata, airbyte-server-fips, kserve-modelmesh, opensearch, apache-hop-fips, keycloak-fips, apache-hop, druid,...
GHSA-X4GW-5CX5-PGMH vulnerabilities
Vulnerabilities for packages: opensearch-fips, apache-activemq-artemis, zipkin, management-api-for-apache-cassandra-5.0, kafbat-ui-fips, spark, hono, akhq, request-9047-keycloak-fips, seata, airbyte-server-fips, kserve-modelmesh, opensearch, apache-hop-fips, keycloak-fips, apache-hop, druid,...
GHSA-3QP7-7MW8-WX86 vulnerabilities
Vulnerabilities for packages: opensearch-fips, apache-activemq-artemis, zipkin, management-api-for-apache-cassandra-5.0, kafbat-ui-fips, spark, hono, akhq, request-9047-keycloak-fips, seata, airbyte-server-fips, kserve-modelmesh, opensearch, apache-hop-fips, keycloak-fips, apache-hop, druid,...
The vulnerability of Keycloak’s client authentication mechanism in the UDS Identity Config configuration package allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the client authentication mechanism in the UDS Identity Config configuration package is related to deficiencies in the authentication process. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protecte...
Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to Authentication Bypass by Alternate Name CVE-2025-14777
Summary keycloak is used by the IBM Datapower Operations Dashboard as part of their IAM and SSO implementation Vulnerability Details CVEID:CVE-2025-14777 DESCRIPTION: A flaw was found in Keycloak. An IDOR Broken Access Control vulnerability exists in the admin API endpoints for authorization...
Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to Incorrect Behavior Order CVE-2026-0707
Summary keycloak is used by the IBM Datapower Operations Dashboard as part of their IAM and SSO implementation Vulnerability Details CVEID:CVE-2026-0707 DESCRIPTION: A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer...
Security Bulletin: IBM Datapower Operations Dashboard is vulnerable to Server-side Request Forgery CVE-2026-1180
Summary keycloak is used by the IBM Datapower Operations Dashboard as part of their IAM and SSO implementation Vulnerability Details CVEID:CVE-2026-1180 DESCRIPTION: A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjw...
CVE-2026-11577
Rejected reason: The reported behavior does not constitute a privilege escalation. Exploitation requires the attacker to already possess the manage-realm administrative role within the realm-management client. By design, the manage-realm role is intended to be equivalent in administrative authori...
CVE-2026-11577
...
EUVD-2026-35058
A flaw was found in Keycloak. A limited administrator can exploit an improper access control vulnerability in the POST /admin/realms/realm/partialImport endpoint. This allows them to bypass Fine-Grained Admin Permissions FGAP and escalate their privileges to a full realm administrator by importin...
CVE-2026-11577
A flaw was found in Keycloak. A limited administrator can exploit an improper access control vulnerability in the POST /admin/realms/realm/partialImport endpoint. This allows them to bypass Fine-Grained Admin Permissions FGAP and escalate their privileges to a full realm administrator by importin...
CVE-2026-11577
Keycloak vulnerability CVE-2026-11577 involves improper access control in POST /admin/realms/{realm}/partialImport. A limited administrator with the manage-realm role can import users with realm-admin role mappings to escalate to a full realm administrator, gaining full control. By design, manage...
Incorrect Authorization
Amendment This was deemed not a vulnerability. Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Authorization via the partialImport feature. An...
Keycloak 授权问题漏洞
Keycloak is an open-source identity and access management solution developed by Keycloak. There is a security vulnerability in Keycloak. This vulnerability stems from improper access control in the POST /admin/realms/realm/partialImport endpoint, which may allow limited administrators to bypass...
CVE-2026-33585
Improper management of the idle timeout parameter in the Keycloak interface of the Arqit SKA-Platform enables an attacker to impersonate an authenticated tenant user via an unexpired browser session. This issue affects Symmetric Key Agreement Platform: before 26.03...