Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the DefaultPolicyEvaluator in authorization...

Malicious code in keycloak-server (npm)

Source: ossf-package-analysis 3df989aa26dccceca3917c9b3454427df4f54e9c104fbc080e913d30af3e66b2 The OpenSSF Package Analysis project identified 'keycloak-server' @ 0.0.2 npm as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious...

CVE-2026-15945

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +397 more potentially affected by CVE-2026-16093 via org.keycloak:keycloak-server-spi-private (>=13.0.0, <=26.7.2)

org.keycloak:keycloak-server-spi-private MAVEN version =13.0.0, =0.1.0, =0.11.0, =0.10.4, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.0.28 and more Source cves: CVE-2026-16093 Source advisory: SNYK:JAVA-ORGKEYCLOAK-19477241...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +405 more potentially affected by CVE-2026-15943 via org.keycloak:keycloak-server-spi (>=2.4.0.cr1, <=26.8.0)

org.keycloak:keycloak-server-spi MAVEN version =2.4.0.cr1, =0.1.0, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.4.3, =1.4.3, =1.6.0 and more Source cves: CVE-2026-15943 Source advisory: SNYK:JAVA-ORGKEYCLOAK-21707365...

Improper Validation of Consistency within Input

Overview org.keycloak:keycloak-server-spi is a Affected versions of this package are vulnerable to Improper Validation of Consistency within Input. in the identity provider update flow for OIDC identity providers. An attacker can capture the existing client secret by sending an update as a...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +420 more potentially affected by CVE-2026-16104 via org.keycloak:keycloak-server-spi-private (>=2.4.0.cr1, <=26.7.2)

org.keycloak:keycloak-server-spi-private MAVEN version =2.4.0.cr1, =0.1.0, =0.11.0, =0.10.4, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.0.28 and more Source cves: CVE-2026-16104 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18751621...

PYSEC-2026-828 keycloak-httpd-client-install Insecure Secrets

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +419 more potentially affected by CVE-2026-14615 via org.keycloak:keycloak-server-spi-private (>=2.4.0.cr1, <=26.7.0)

org.keycloak:keycloak-server-spi-private MAVEN version =2.4.0.cr1, =0.1.0, =0.11.0, =0.10.4, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.0.28 and more Source cves: CVE-2026-14615 Source advisory: SNYK:JAVA-ORGKEYCLOAK-17892373...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +408 more potentially affected by CVE-2026-9799 via org.keycloak:keycloak-server-spi-private (>=2.4.0.cr1, <=26.6.3)

org.keycloak:keycloak-server-spi-private MAVEN version =2.4.0.cr1, =0.1.0, =0.11.0, =0.10.4, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.0.28 and more Source cves: CVE-2026-9799 Source advisory: MEND:CVE-2026-9799...

org.keycloak.keycloak-services: Improper Access Control on Keycloak Server when the account Account API feature is disabled

When Keycloak is started with --features-disabled=account,account-api, the Account REST API is only partially disabled. Five endpoints under the versioned path /account/v1alpha1 remain fully functional — including both read and write operations — because they lack the checkAccountApiEnabled gate...

com.github.vzakharchenko:rad-sec-plugin (1.6.1), com.github.vzakharchenko:radius-disconnect-plugin (1.6.1) +119 more potentially affected by CVE-2026-9088 via org.keycloak:keycloak-server-spi-private (>=26.3.0, <=26.6.2)

org.keycloak:keycloak-server-spi-private MAVEN version =26.3.0, =1.0.0, =1.2.0, =1.1.0, =1.0.1, =1.1.0, =5.4.4-26.4, =5.4.4-26.4, =2.4.5, =2.0.3-26.4, =2.3.0 and more Source cves: CVE-2026-9088 Source advisory: MEND:CVE-2026-9088https://vulners.com/mend/MEND:CVE-2026...

com.inventage.keycloak.log-level:keycloak-log-level (1.0.0), com.inventage.keycloak.role-based-timeout:keycloak-role-based-timeout (>=1.0.0, <=1.2.0) +104 more potentially affected by CVE-2026-9791 via org.keycloak:keycloak-server-spi-private (>=26.5.0, <=26.6.2)

org.keycloak:keycloak-server-spi-private MAVEN version =26.5.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.11.17, =1.1.2, =1.2.4 and more Source cves: CVE-2026-9791 Source advisory: GHSA-4Q93-V92X-P89Fhttps://vulners.com/github/GHSA-4Q93-V9...

Incorrect Authorization

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Authorization via the user-facing APIs when the Organizations feature is disabled. An...

Improper Isolation or Compartmentalization

Overview Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through improper handling of single-use entries in the SingleUseObjectProvider a global key-value store. An attacker can gain unauthorized access or compromise accounts by replaying consumed...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +390 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-server-spi-private (>=2.4.0.cr1, <=26.5.5)

org.keycloak:keycloak-server-spi-private MAVEN version =2.4.0.cr1, =0.1.0, =0.11.0, =0.10.4, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.0.28 and more Source cves: CVE-2026-3190 Source advisory: OSV:GHSA-Q35R-VVHV-VX5H...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +390 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-server-spi-private (>=2.4.0.cr1, <=26.5.5)

org.keycloak:keycloak-server-spi-private MAVEN version =2.4.0.cr1, =0.1.0, =0.11.0, =0.10.4, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.0.28 and more Source cves: CVE-2026-3190 Source advisory: GHSA-Q35R-VVHV-VX5H...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +390 more potentially affected by CVE-2026-3190 via org.keycloak:keycloak-server-spi-private (>=2.4.0.cr1, <=26.5.5)

org.keycloak:keycloak-server-spi-private MAVEN version =2.4.0.cr1, =0.1.0, =0.11.0, =0.10.4, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.0.28 and more Source cves: CVE-2026-3190 Source advisory: MEND:CVE-2026-3190...

com.github.vzakharchenko:rad-sec-plugin (1.6.1), com.github.vzakharchenko:radius-disconnect-plugin (1.6.1) +88 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-server-spi-private (>=26.3.0, <=26.4.7)

org.keycloak:keycloak-server-spi-private MAVEN version =26.3.0, =1.1.0, =1.0.1, =1.1.0, =5.4.4-26.4, =5.4.4-26.4, =2.0.3-26.4, =0.1.0, =1.11.3, =0.7, =0.47, =0.50 and more Source cves: CVE-2026-3009 Source advisory: SNYK:JAVA-ORGKEYCLOAK-15440476...

com.github.vzakharchenko:rad-sec-plugin (1.6.1), com.github.vzakharchenko:radius-disconnect-plugin (1.6.1) +88 more potentially affected by CVE-2026-2603 via org.keycloak:keycloak-server-spi-private (>=26.3.0, <=26.4.7)

org.keycloak:keycloak-server-spi-private MAVEN version =26.3.0, =1.1.0, =1.0.1, =1.1.0, =5.4.4-26.4, =5.4.4-26.4, =2.0.3-26.4, =0.1.0, =1.11.3, =0.7, =0.47, =0.50 and more Source cves: CVE-2026-2603 Source advisory: SNYK:JAVA-ORGKEYCLOAK-15440568...