BIT-KEYCLOAK-2024-7260 Keycloak-core: open redirect on account page

An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referreruri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.boozallen.aissemble:extensions-authzforce (>=1.13.0-rc6, <=2.0.0) +201 more potentially affected by CVE-2026-16102 via org.keycloak:keycloak-core (>=26.0.0, <=26.7.0)

org.keycloak:keycloak-core MAVEN version =26.0.0, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =2.0.0 - com.caputchin:caputchin-keycloak 0.2.0 - com.github.vzakharchenko:mikrotik-radius-plugin 1.6.1 - com.github.vzakharchenko:proxy-radius-plugin 1.6.1 -...

EUVD-2026-51483

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the...

CVE-2026-18211: Improper Input Validation

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the...

Improper Verification of Cryptographic Signature

Overview org.keycloak:keycloak-core is an open source identity and access management solution. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the JWT Authorization Grant flow due to algorithm confusion in signature verification. An attacke...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.boozallen.aissemble:extensions-authzforce (>=1.13.0-rc6, <=2.0.0) +186 more potentially affected by CVE-2026-11800 via org.keycloak:keycloak-core (>=26.0.0, <=26.6.3)

org.keycloak:keycloak-core MAVEN version =26.0.0, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.0.0, =1.2.0 and more Source cves: CVE-2026-11800 Source advisory: SNYK:JAVA-ORGKEYCLOAK-17660979...

be.jidoka:jdk-keycloak-admin (1.2.0), ca.bc.gov.tno:dal-db (>=0.0.9-alpha, <=0.0.17-alpha) +159 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (15.0.2)

org.keycloak:keycloak-core MAVEN version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - be.jidoka:jdk-keycloak-admin 1.2.0 - ca.bc.gov.tno:dal-db =0.0.9-alpha, =0.0.1-alpha, =0.2.0, =0.2.0,...

io.apiman.plugins:apiman-plugins-keycloak-oauth-policy (>=2.2.0.final, <=2.2.3.final), io.apiman:apiman-manager-api-security (>=2.2.0.final, <=2.2.3.final) +72 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (15.1.1)

org.keycloak:keycloak-core MAVEN version 15.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.apiman.plugins:apiman-plugins-keycloak-oauth-policy =2.2.0.final, =2.2.0.final, =5.3.0.alpha2,...

com.avast.grpc.jwt:grpc-java-jwt-keycloak (0.5.2), com.c4-soft.springaddons:keycloak-grants-mapper (>=3.1.13-jdk1.8, <=3.1.14-jdk17) +104 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (16.1.0)

org.keycloak:keycloak-core MAVEN version 16.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.avast.grpc.jwt:grpc-java-jwt-keycloak 0.5.2 - com.c4-soft.springaddons:keycloak-grants-mapper...

io.quarkus:quarkus-keycloak (>=0.14.0, <=0.15.0), io.quarkus:quarkus-keycloak-deployment (>=0.14.0, <=0.15.0) +67 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (6.0.0)

org.keycloak:keycloak-core MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - io.quarkus:quarkus-keycloak =0.14.0, =0.14.0, =1.9.0, =1.9.0, =1.9.4 - org.keycloak:keycloak-adapter-core...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), de.retest:recheck (>=1.2.0-beta.1, <=1.4.0) +83 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (6.0.1)

org.keycloak:keycloak-core MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =1.2.0-beta.1, =1.3.0-beta.1, =0.0.7, =0.0.7, =0.0.6,...

com.mjamsek.auth:kee-auth (1.0.0), de.retest:recheck (>=1.6.0-beta.1, <=1.7.0) +105 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (7.0.1)

org.keycloak:keycloak-core MAVEN version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.mjamsek.auth:kee-auth 1.0.0 - de.retest:recheck =1.6.0-beta.1, =1.6.0-beta.1, =1.6.0-beta.1,...

com.c4-soft.springaddons:spring-security-test-keycloack-addons (1.2.0), com.github.vzakharchenko:keycloak-plugins (1.0.2) +64 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (8.0.2)

org.keycloak:keycloak-core MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.c4-soft.springaddons:spring-security-test-keycloack-addons 1.2.0 -...

edu.byu.hbll.maven:application-parent (>=3.0.0, <=3.4.0), org.keycloak:keycloak-adapter-core (4.8.2.final) +64 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (4.8.2.final)

org.keycloak:keycloak-core MAVEN version 4.8.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - edu.byu.hbll.maven:application-parent =3.0.0, =3.4.0 - org.keycloak:keycloak-adapter-core 4.8.2.final...

com.kurzdigital:keycloak-admin-wrapper (>=0.9.11, <=0.10.3), com.pleosoft:pleosoft-spring-boot-starter (1.0.5-release) +105 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (4.8.3.final)

org.keycloak:keycloak-core MAVEN version 4.8.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.kurzdigital:keycloak-admin-wrapper =0.9.11, =1.1.0, =1.2.2, =1.2.2, =7.1.0.m5, =7.1.0.m5,...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.6), com.github.vzakharchenko:cisco-radius-plugin (1.3.6) +137 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (13.0.0)

org.keycloak:keycloak-core MAVEN version 13.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.6 - com.github.vzakharchenko:cisco-radius-plugin 1.3...

ca.bc.gov.tno:dal-db (0.0.8-alpha), com.avast.grpc.jwt:grpc-java-jwt-keycloak (0.4.12) +102 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (13.0.1)

org.keycloak:keycloak-core MAVEN version 13.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - ca.bc.gov.tno:dal-db 0.0.8-alpha - com.avast.grpc.jwt:grpc-java-jwt-keycloak 0.4.12 -...

org.keycloak:keycloak-adapter-core (8.0.0), org.keycloak:keycloak-admin-client (8.0.0) +57 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (8.0.0)

org.keycloak:keycloak-core MAVEN version 8.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 8.0.0 - org.keycloak:keycloak-admin-client 8.0.0 -...

com.github.vzakharchenko:keycloak-plugins (>=0.1, <=1.0.1), com.github.vzakharchenko:mikrotik-radius-plugin (>=0.1, <=1.0.1) +93 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (8.0.1)

org.keycloak:keycloak-core MAVEN version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:keycloak-plugins =0.1, =0.1, =0.1, =0.1, =1.8.0-beta.1, =1.8.0-beta.1,...

com.abavilla:fpi-bot-api (>=1.6.0, <=1.8.0), com.abavilla:fpi-bot-api-parent (>=1.6.0, <=1.8.0) +107 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (21.0.2)

org.keycloak:keycloak-core MAVEN version 21.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.abavilla:fpi-bot-api =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.6.0, =1.6.0, =1.8.0, =1.8.0, =1.0.25, =1.0.25,...