EUVD-2026-51478

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

CVE-2026-18218

The vulnerability CVE-2026-18218 affects Keycloak’s TokenManager component. When an administrator revokes tokens for a specific client under a not-before policy, revocation can be silently ignored if the realm’s overall not-before policy is older but non-zero. As a result, previously issued token...

CVE-2026-18218

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

CVE-2026-18218 Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

Keycloak <= 12.0.1 - request_uri Blind Server-Side Request Forgery (SSRF)

Keycloak 12.0.1 and below allows an attacker to force the server to request an unverified URL using the OIDC parameter requesturi. This allows an attacker to execute a server-side request forgery SSRF attack. id: CVE-2020-10770 info: name: Keycloak = 12.0.1 - requesturi Blind Server-Side Request...

CVE-2026-50559 vulnerabilities

Vulnerabilities for packages: keycloak-fips, hono, request-9047-keycloak-fips, floci-az, apicurio-registry...

GHSA-QCXP-GM7M-4J5V vulnerabilities

Vulnerabilities for packages: keycloak-fips, hono, request-9047-keycloak-fips, floci-az, apicurio-registry...

PT-2026-66727

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description Keycloak allows authentication via Google accounts and can be restricted to specific Google Workspace domains. A flaw exists in the token exchange feature, which enables the swapping of a...

PT-2026-66722

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the group policy evaluation logic of Keycloak. When a group policy is configured to extend permissions to child groups, the system employs a simple text-based prefix check t...

PT-2026-66870

Name of the Vulnerable Software and Affected Versions GeoNetwork versions 3.12.0 through 4.2.15 GeoNetwork versions 4.4.0 through 4.4.10 Description Unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter allows an attacker to redirect...

CLEANSTART-2026-WW01909 Security fixes in keycloak 26.3.5-r3

Package keycloak version 26.3.5-r3 fixes 24 vulnerabilities: CVE-2026-42583, CVE-2026-42579, CVE-2026-44893, CVE-2026-48059, CVE-2026-33870...

CLEANSTART-2026-QW10501 Security fixes in keycloak 26.4.10-r0

Package keycloak version 26.4.10-r0 fixes 26 vulnerabilities: CVE-2026-42579, CVE-2026-42587, CVE-2026-42583, CVE-2026-42584, CVE-2026-33871...

CLEANSTART-2026-HT07249 Security fixes in keycloak 26.5.7-r0

Package keycloak version 26.5.7-r0 fixes 34 vulnerabilities: CVE-2025-11965, CVE-2025-11966, CVE-2025-59250, CVE-2026-0636, CVE-2026-5588...

CLEANSTART-2026-BA48144 Security fixes in keycloak 26.5.7-r5

Package keycloak version 26.5.7-r5 fixes 11 vulnerabilities: CVE-2026-54291, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515...

CLEANSTART-2026-TO43731 Security fixes in keycloak 26.4.7-r7

Package keycloak version 26.4.7-r7 fixes 2 vulnerabilities: CVE-2026-40984, CVE-2026-50559...

CVE-2026-18201

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

CVE-2026-18207

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a...

CVE-2026-18201 Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

CVE-2026-18201 Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

CVE-2026-18201

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...