Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the SAMLRequest DEFLATE decompression. An attacker can cause service disruption by sending a highly compressed requests that trigger excessive resource consumption durin...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview org.keycloak:keycloak-saml-core is an Identity and Access Management plugin for Keycloak. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the SAMLRequest DEFLATE decompression. An attacker can cause service disruption...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +194 more potentially affected by CVE-2026-2575 via org.keycloak:keycloak-services (>=1.9.0.cr1, <=26.5.3)

org.keycloak:keycloak-services MAVEN version =1.9.0.cr1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =1.4.11 - com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak 24.3.0.0 and more Source cves: CVE-2026-2575 Source advisory:...

PT-2026-8388

Name of the Vulnerable Software and Affected Versions Rocket TRUfusion Enterprise versions through 7.10.5 Description Rocket TRUfusion Enterprise through version 7.10.5 has a path traversal issue in the WsPortalV6UpDwAxis2Impl service, accessible via the API endpoint...

oidc-poc

OIDC SSO Proof of Concept Proof of concept for bidirectional...

Keycloak 安全漏洞

Keycloak is an open-source identity and access management solution developed by Keycloak. Keycloak has a security vulnerability, which stems from an authorization bypass in the Admin API. This vulnerability may lead to information leakage...

Keycloak JSON Web Token Handler Unauthorized Access

The vulnerability of the JSON Web Token Handler component in the software for managing identification and access in Keycloak is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to...

Keycloak Detection Consolidation

Consolidation of Keycloak detections. SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; if description...

CVE-2026-1190 vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

GHSA-63V5-26VQ-M4VM vulnerabilities

Vulnerabilities for packages: keycloak-fips, keycloak...

Exploit for CVE-2026-1529

CVE-2026-1529 Keycloak Exploit Tool Keycloak: Unauthorized...

GHSA-63V5-26VQ-M4VM vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-1190 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-GV3V-2CPP-3PMQ Keycloak logs sensitive headers

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

Keycloak logs sensitive headers

A flaw was found in Keycloak. When the logging format is configured to a verbose, user-supplied pattern such as the pre-defined 'long' pattern, sensitive headers including Authorization and Cookie are disclosed to the logs in cleartext. An attacker with read access to the log files can extract...

org.keycloak:keycloak-quarkus-server-app (12.0.1), org.keycloak:keycloak-quarkus-server-deployment (12.0.1) potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (12.0.1)

org.keycloak:keycloak-quarkus-server MAVEN version 12.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-quarkus-server-app 12.0.1 -...

org.keycloak:keycloak-guides (23.0.4), org.keycloak:keycloak-guides-maven-plugin (23.0.4) +3 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (23.0.4)

org.keycloak:keycloak-quarkus-server MAVEN version 23.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 23.0.4 - org.keycloak:keycloak-guides-maven-plugin 23.0.4...

org.keycloak:keycloak-quarkus-server-app (14.0.0), org.keycloak:keycloak-quarkus-server-deployment (14.0.0) potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (14.0.0)

org.keycloak:keycloak-quarkus-server MAVEN version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-quarkus-server-app 14.0.0 -...

org.keycloak:keycloak-guides (24.0.0), org.keycloak:keycloak-guides-maven-plugin (24.0.0) +3 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (24.0.0)

org.keycloak:keycloak-quarkus-server MAVEN version 24.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 24.0.0 - org.keycloak:keycloak-guides-maven-plugin 24.0.0...

org.keycloak:keycloak-guides (25.0.5), org.keycloak:keycloak-guides-maven-plugin (25.0.5) +3 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (25.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version 25.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-server and may be impacted: - org.keycloak:keycloak-guides 25.0.5 - org.keycloak:keycloak-guides-maven-plugin 25.0.5...