CVE-2025-13881

A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings...

CVE-2025-13881 Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api

A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings...

PT-2026-5499

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Keycloak Admin API that allows an administrator with limited privileges to retrieve sensitive custom attributes. This is achieved through the /unmanagedAttributes API...

GHSA-594W-2FWP-JWRC Keycloak Admin REST API exposes backend schema and rules

A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.10), com.github.vzakharchenko:cisco-radius-plugin (1.4.10) +25 more potentially affected by CVE-2025-14083 via org.keycloak:keycloak-services (20.0.3)

org.keycloak:keycloak-services MAVEN version 20.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.10 -...

CVE-2025-14083

A flaw was found in the Keycloak Admin REST API. This vulnerability allows the exposure of backend schema and rules, potentially leading to targeted attacks or privilege escalation via improper access control...

CVE-2025-14082

A flaw was found in Keycloak Admin REST Representational State Transfer API. This vulnerability allows information disclosure of sensitive role metadata via insufficient authorization checks on the /admin/realms/realm/roles endpoint...

CVE-2025-10939 Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console

A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /admin application path relative to...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (4.0.2-25.0), org.keycloak:keycloak-dependencies-server-all (25.0.4) +8 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (25.0.4)

org.keycloak:keycloak-admin-ui MAVEN version 25.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-model-tests 4.0.2-25.0 -...

org.keycloak:keycloak-guides (18.0.2), org.keycloak:keycloak-guides-maven-plugin (18.0.2) +4 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (18.0.2)

org.keycloak:keycloak-admin-ui MAVEN version 18.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - org.keycloak:keycloak-guides 18.0.2 - org.keycloak:keycloak-guides-maven-plugin 18.0.2 -...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0, <=2.7.4-24.0), org.keycloak:keycloak-dependencies-server-all (24.0.2) +8 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (24.0.2)

org.keycloak:keycloak-admin-ui MAVEN version 24.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-model-tests =2.5.6-24.0, =2.7.4-24.0 -...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (19.0.2), org.keycloak:keycloak-quarkus-integration-tests (19.0.2) +5 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (19.0.2)

org.keycloak:keycloak-admin-ui MAVEN version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 19.0.2 -...

org.keycloak:keycloak-guides (22.0.0), org.keycloak:keycloak-guides-maven-plugin (22.0.0) +4 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (22.0.0)

org.keycloak:keycloak-admin-ui MAVEN version 22.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - org.keycloak:keycloak-guides 22.0.0 - org.keycloak:keycloak-guides-maven-plugin 22.0.0 -...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0, <=4.0.1-25.0), org.keycloak:keycloak-dependencies-server-all (25.0.1) +8 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (25.0.1)

org.keycloak:keycloak-admin-ui MAVEN version 25.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-model-tests =3.0.1-25.0, =4.0.1-25.0 -...

org.keycloak:keycloak-guides (21.1.1), org.keycloak:keycloak-guides-maven-plugin (21.1.1) +4 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (21.1.1)

org.keycloak:keycloak-admin-ui MAVEN version 21.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - org.keycloak:keycloak-guides 21.1.1 - org.keycloak:keycloak-guides-maven-plugin 21.1.1 -...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.5), org.keycloak:keycloak-quarkus-integration-tests (20.0.5) +3 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (20.0.5)

org.keycloak:keycloak-admin-ui MAVEN version 20.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.5 -...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (19.0.1), org.keycloak:keycloak-quarkus-integration-tests (19.0.1) +5 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (19.0.1)

org.keycloak:keycloak-admin-ui MAVEN version 19.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 19.0.1 -...

org.keycloak:keycloak-dependencies-admin-ui-wrapper (20.0.3), org.keycloak:keycloak-quarkus-integration-tests (20.0.3) +3 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (20.0.3)

org.keycloak:keycloak-admin-ui MAVEN version 20.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - org.keycloak:keycloak-dependencies-admin-ui-wrapper 20.0.3 -...

org.keycloak:keycloak-api-docs-dist (16.0.0), org.keycloak:keycloak-dependencies-server-all (16.0.0) +2 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (16.0.0)

org.keycloak:keycloak-admin-ui MAVEN version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - org.keycloak:keycloak-api-docs-dist 16.0.0 - org.keycloak:keycloak-dependencies-server-all 16.0.0 ...

org.keycloak:keycloak-api-docs-dist (16.1.1), org.keycloak:keycloak-dependencies-server-all (16.1.1) +2 more potentially affected by CVE-2025-10044 via org.keycloak:keycloak-admin-ui (16.1.1)

org.keycloak:keycloak-admin-ui MAVEN version 16.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-admin-ui and may be impacted: - org.keycloak:keycloak-api-docs-dist 16.1.1 - org.keycloak:keycloak-dependencies-server-all 16.1.1 ...