GHSA-RX66-HJ7G-28H7 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-RHGQ-F8X5-J2JC vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-4325 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-3872 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-H4WV-G838-66G3 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-CJM2-J6CM-6P6M vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-4636 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-4634 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-4633 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-HJ93-H7PG-FH6V vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-F2HX-5FX3-HMCV vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2026-4282 vulnerabilities

Vulnerabilities for packages: keycloak...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ResourceService in the resource management API. An...

CLEANSTART-2026-QI14017 Vert

Multiple security vulnerabilities affect the keycloak package. The Vert. See references for individual vulnerability details...

CLEANSTART-2026-FA60324 It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session

Multiple security vulnerabilities affect the keycloak package. It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. See references for individual vulnerability details...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0), com.charlyghislain.keycloak:keycloak-importexport (>=21.0.0 <=23.0.1) +160 more potentially affected by CVE-2026-37980 via org.keycloak:keycloak-services (>=1.0-alpha-1 <=26.5.5)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =21.0.0, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.0.0, =1.2.0 and more Source cves: CVE-2026-37980 Source advisory: OSV:GHSA-M32F-8VH9-2HH3https://vulners.com/osv/OSV:GHSA-M32F-8VH...

Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting XSS vulnerability. This flaw occurs because the organization.alias is placed into an...

GHSA-M32F-8VH9-2HH3 Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting XSS vulnerability. This flaw occurs because the organization.alias is placed into an...

EUVD-2026-22294

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting XSS vulnerability. This flaw occurs because the organization.alias is placed into an...

CVE-2026-37980

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with manage-realm or manage-organizations administrative privileges can exploit a Stored Cross-Site Scripting XSS vulnerability. This flaw occurs because the organization.alias is placed into an...