de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=1.1.0-22.0.1, <=1.3.2-22.0.1), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=1.1.0-22.0.1, <=1.3.2-22.0.1) +29 more potentially affected by CVE-2026-7504 via org.keycloak:keycloak-services (22.0.1)

org.keycloak:keycloak-services MAVEN version 22.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =1.1.0-22.0.1, =1.1.0-22.0.1, =1.0.1, =1.0.2 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.0.0.beta1), org.keycloak:keycloak-account-freemarker (1.0-beta-3) +1 more potentially affected by CVE-2026-7504 via org.keycloak:keycloak-services (1.0-beta-3)

org.keycloak:keycloak-services MAVEN version 1.0-beta-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =0.11.0, =1.0.0.beta1 -...

Keycloak: Access token disclosure and implicit flow bypass via forged client data

A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect OIDC clients. By manipulating client data during a session restart, an attacker can obtain an access token th...

Keycloak: Session fixation in OIDC login flow that can lead to account takeover

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which...

GHSA-HF67-5VVQ-FM3R Keycloak: Session fixation in OIDC login flow that can lead to account takeover

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link. By leveraging the /login-actions/restart endpoint—which...

org.keycloak:keycloak-authz-policy-drools (2.4.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.4.0.cr1) +5 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (2.4.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.4.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.4.0.cr1 -...

Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak

A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive information within the domain or facilitating further...

org.keycloak:keycloak-authz-policy-drools (2.5.0.final), org.keycloak:keycloak-dependencies-server-all (2.5.0.final) +5 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (2.5.0.final)

org.keycloak:keycloak-services MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.0.final -...

dev.jcputney:keycloak-theme-additional-info-extension (>=1.1.4, <=1.1.5), org.keycloak:keycloak-crypto-fips1402 (23.0.2) +13 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (23.0.2)

org.keycloak:keycloak-services MAVEN version 23.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - dev.jcputney:keycloak-theme-additional-info-extension =1.1.4, =1.1.5 -...

org.keycloak:keycloak-dependencies-server-min (4.0.0.beta3), org.keycloak:keycloak-model-jpa (4.0.0.beta3) +2 more potentially affected by CVE-2026-7507 via org.keycloak:keycloak-services (4.0.0.beta3)

org.keycloak:keycloak-services MAVEN version 4.0.0.beta3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.0.0.beta3 - org.keycloak:keycloak-model-jpa...

com.github.vzakharchenko:keycloak-plugins (1.2.4), com.github.vzakharchenko:mikrotik-radius-plugin (1.2.4) +12 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (10.0.1)

org.keycloak:keycloak-services MAVEN version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.2.4 - com.github.vzakharchenko:mikrotik-radius-plugin...

org.keycloak:keycloak-authz-policy-drools (2.5.0.final), org.keycloak:keycloak-dependencies-server-all (2.5.0.final) +5 more potentially affected by CVE-2026-7504 via org.keycloak:keycloak-services (2.5.0.final)

org.keycloak:keycloak-services MAVEN version 2.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.5.0.final -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=3.0.1-25.0, <=4.0.1-25.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0, <=4.0.1-25.0) +25 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (25.0.1)

org.keycloak:keycloak-services MAVEN version 25.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =3.0.1-25.0, =3.0.1-25.0, =4.0.1-25.0 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.0.0-23.0, <=2.5.1-23.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.0.0-23.0, <=2.5.1-23.0) +28 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (23.0.1)

org.keycloak:keycloak-services MAVEN version 23.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.0.0-23.0, =2.0.0-23.0, =0.19, =0.16, =4.2,...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.5), com.github.vzakharchenko:cisco-radius-plugin (1.4.5) +32 more potentially affected by CVE-2026-7507 via org.keycloak:keycloak-services (18.0.1)

org.keycloak:keycloak-services MAVEN version 18.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.5 -...

GHSA-HQ3P-W4XV-X7VP Keycloak: Access token disclosure and implicit flow bypass via forged client data

A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect OIDC clients. By manipulating client data during a session restart, an attacker can obtain an access token th...

org.keycloak:keycloak-account-freemarker (1.0.3.final), org.keycloak:keycloak-dependencies-server-all (1.0.3.final) +3 more potentially affected by CVE-2026-7504 via org.keycloak:keycloak-services (1.0.3.final)

org.keycloak:keycloak-services MAVEN version 1.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0.3.final -...

org.keycloak:keycloak-dependencies-server-min (4.0.0.final), org.keycloak:keycloak-model-jpa (4.0.0.final) +2 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (4.0.0.final)

org.keycloak:keycloak-services MAVEN version 4.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-min 4.0.0.final - org.keycloak:keycloak-model-jpa...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.0.2, <=1.1.0-alpha.1), org.keycloak:keycloak-account-freemarker (1.0.4.final) +4 more potentially affected by CVE-2026-7571 via org.keycloak:keycloak-services (1.0.4.final)

org.keycloak:keycloak-services MAVEN version 1.0.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.0.2, =1.1.0-alpha.1 -...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), dk.grinn.keycloak:keycloak-migrate-resource (>=0.0.6, <=1.0.11) +9 more potentially affected by CVE-2026-7504 via org.keycloak:keycloak-services (6.0.1)

org.keycloak:keycloak-services MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =0.0.6, =0.0.6, =1.0.11 -...