org.commonjava.aprox.embed:aprox-embedder-easyprox (>=0.23.0, <=0.25.1), org.commonjava.aprox.embed:aprox-embedder-min (>=0.23.0, <=0.25.1) +44 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.2.0.final)

org.keycloak:keycloak-adapter-core MAVEN version 1.2.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.commonjava.aprox.embed:aprox-embedder-easyprox =0.23.0, =0.23.0, =0.23.0, =0.23.0...

org.keycloak:keycloak-installed-adapter (1.2.0.cr1), org.keycloak:keycloak-jaxrs-oauth-client (1.2.0.cr1) +23 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.2.0.cr1)

org.keycloak:keycloak-adapter-core MAVEN version 1.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-installed-adapter 1.2.0.cr1 -...

org.keycloak:keycloak-appliance-dist-all (1.2.0.beta1), org.keycloak:keycloak-as7-adapter-dist (1.2.0.beta1) +26 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.2.0.beta1)

org.keycloak:keycloak-adapter-core MAVEN version 1.2.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-appliance-dist-all 1.2.0.beta1 -...

org.keycloak:keycloak-appliance-dist-all (1.1.1.final), org.keycloak:keycloak-as7-adapter-dist (1.1.1.final) +25 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.1.1.final)

org.keycloak:keycloak-adapter-core MAVEN version 1.1.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-appliance-dist-all 1.1.1.final -...

org.keycloak.secretstore:secret-store (>=1.0.9.final, <=1.0.12.final), org.keycloak.secretstore:secret-store-api (>=1.0.8.final, <=1.0.12.final) +30 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.8.0.cr3)

org.keycloak:keycloak-adapter-core MAVEN version 1.8.0.cr3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak.secretstore:secret-store =1.0.9.final, =1.0.8.final, =1.0.12.final -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (3.0.0), de.fraunhofer.iosb.ilt.frost-server:frost-server.auth.keycloak (>=2.0.13, <=2.3.1) +26 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (23.0.6)

org.keycloak:keycloak-adapter-core MAVEN version 23.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 3.0.0 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.3), com.github.vzakharchenko:cisco-radius-plugin (1.4.3) +60 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (17.0.1)

org.keycloak:keycloak-adapter-core MAVEN version 17.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.3 -...

org.keycloak:keycloak-servlet-oauth-client (1.0-alpha-2), org.keycloak:keycloak-undertow-adapter (1.0-alpha-2) potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-alpha-2)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-alpha-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-servlet-oauth-client 1.0-alpha-2 -...

org.keycloak:keycloak-jboss-adapter-core (1.0-alpha-4), org.keycloak:keycloak-servlet-oauth-client (1.0-alpha-4) +2 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-alpha-4)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-alpha-4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-jboss-adapter-core 1.0-alpha-4 -...

org.keycloak:keycloak-jboss-adapter-core (1.0-alpha-3), org.keycloak:keycloak-servlet-oauth-client (1.0-alpha-3) +2 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-alpha-3)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-alpha-3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-jboss-adapter-core 1.0-alpha-3 -...

org.keycloak:keycloak-servlet-oauth-client (1.0-alpha-1), org.keycloak:keycloak-undertow-adapter (1.0-alpha-1) potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-alpha-1)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-alpha-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-servlet-oauth-client 1.0-alpha-1 -...

GHSA-7VW6-5Q2F-7W5R Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)

A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...

Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)

A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...

com.c4-soft.springaddons:spring-security-test-keycloack-addons (1.2.0), com.github.vzakharchenko:keycloak-plugins (1.0.2) +40 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (8.0.2)

org.keycloak:keycloak-adapter-core MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - com.c4-soft.springaddons:spring-security-test-keycloack-addons 1.2.0 -...

org.keycloak:keycloak-appliance-dist-all (1.0-beta-1), org.keycloak:keycloak-as7-adapter-dist (1.0-beta-1) +8 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-adapter-core (1.0-beta-1)

org.keycloak:keycloak-adapter-core MAVEN version 1.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-adapter-core and may be impacted: - org.keycloak:keycloak-appliance-dist-all 1.0-beta-1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=0.11.0, <=1.2.0-beta.1), org.keycloak:keycloak-account-freemarker (>=1.0-alpha-2, <=1.8.1.final) +19 more potentially affected by CVE-2026-1180 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=2.5.5.final)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.11.0, =1.0-alpha-2, =2.0.0.cr1, =1.2.0.beta1, =1.2.0.cr1, =1.2.0.cr1, =1.0-beta-4, =1.0-beta-4, =1.6.0.final, =1.0-alpha-1, =1.0-alpha-2, =1.9.0.cr1, =2.3.0.cr1, =1.0-alpha-2, =1.2.0.cr1, =1.8.1.final and more Source cves: CVE-2026-118...

Server-side Request Forgery (SSRF)

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the jwksuri parameter in the OpenID Connect Dynamic Client Registration...

CVE-2026-1180

A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...

CVE-2026-1180

A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...

CVE-2026-1180 Org.keycloak.protocol.oidc: blind server-side request forgery (ssrf) in keycloak oidc dynamic client registration via jwks_uri

A flaw was identified in Keycloak’s OpenID Connect Dynamic Client Registration feature when clients authenticate using privatekeyjwt. The issue allows a client to specify an arbitrary jwksuri, which Keycloak then retrieves without validating the destination. This enables attackers to coerce the...