org.keycloak:keycloak-forms (1.0-alpha-1-12062013), org.keycloak:keycloak-server (1.0-alpha-1-12062013) potentially affected by CVE-2025-14559 via org.keycloak:keycloak-services (1.0-alpha-1-12062013)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-1-12062013 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-forms 1.0-alpha-1-12062013 - org.keycloak:keycloak-server...

org.keycloak:keycloak-account-freemarker (1.0.2.final), org.keycloak:keycloak-dependencies-server-all (1.0.2.final) +3 more potentially affected by CVE-2025-14559 via org.keycloak:keycloak-services (1.0.2.final)

org.keycloak:keycloak-services MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0.2.final -...

org.keycloak:keycloak-account-freemarker (1.0.2.final), org.keycloak:keycloak-dependencies-server-all (1.0.2.final) +3 more potentially affected by CVE-2026-1035 via org.keycloak:keycloak-services (1.0.2.final)

org.keycloak:keycloak-services MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0.2.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.0.2, <=1.1.0-alpha.1), org.keycloak:keycloak-account-freemarker (1.0.4.final) +4 more potentially affected by CVE-2026-1035 via org.keycloak:keycloak-services (1.0.4.final)

org.keycloak:keycloak-services MAVEN version 1.0.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.0.2, =1.1.0-alpha.1 -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.0.final), org.keycloak:keycloak-account-freemarker (1.0-rc-1) +4 more potentially affected by CVE-2026-1035 via org.keycloak:keycloak-services (1.0-rc-1)

org.keycloak:keycloak-services MAVEN version 1.0-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.0.final -...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.1), org.keycloak:keycloak-account-freemarker (1.0-final) +4 more potentially affected by CVE-2026-1035 via org.keycloak:keycloak-services (1.0-final)

org.keycloak:keycloak-services MAVEN version 1.0-final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.1 -...

org.keycloak:keycloak-authz-policy-drools (3.2.0.cr1), org.keycloak:keycloak-dependencies-server-all (3.2.0.cr1) +6 more potentially affected by CVE-2026-1035 via org.keycloak:keycloak-services (3.2.0.cr1)

org.keycloak:keycloak-services MAVEN version 3.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.2.0.cr1 -...

org.keycloak:keycloak-forms (1.0-alpha-1-12062013), org.keycloak:keycloak-server (1.0-alpha-1-12062013) potentially affected by CVE-2026-1035 via org.keycloak:keycloak-services (1.0-alpha-1-12062013)

org.keycloak:keycloak-services MAVEN version 1.0-alpha-1-12062013 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-forms 1.0-alpha-1-12062013 - org.keycloak:keycloak-server...

EUVD-2026-3691

A flaw was found in the Keycloak server during refresh token processing, specifically in the TokenManager class responsible for enforcing refresh token reuse policies. When strict refresh token rotation is enabled, the validation and update of refresh token usage are not performed atomically. Thi...

org.keycloak:keycloak-dependencies-server-all (3.4.0.final), org.keycloak:keycloak-server-feature-pack (3.4.0.final) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (3.4.0.final)

org.keycloak:keycloak-ldap-federation MAVEN version 3.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.4.0.final -...

org.keycloak:keycloak-dependencies-server-all (1.0-rc-1), org.keycloak:keycloak-server (1.0-rc-1) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (1.0-rc-1)

org.keycloak:keycloak-ldap-federation MAVEN version 1.0-rc-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.0-rc-1 -...

org.keycloak:keycloak-dependencies-server-all (3.3.0.cr2), org.keycloak:keycloak-server-feature-pack (3.3.0.cr2) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (3.3.0.cr2)

org.keycloak:keycloak-ldap-federation MAVEN version 3.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.3.0.cr2 -...

org.keycloak:keycloak-dependencies-server-all (1.0.5.final), org.keycloak:keycloak-server (1.0.5.final) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (1.0.5.final)

org.keycloak:keycloak-ldap-federation MAVEN version 1.0.5.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.0.5.final -...

org.keycloak:keycloak-dependencies-server-all (1.0.2.final), org.keycloak:keycloak-server (1.0.2.final) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (1.0.2.final)

org.keycloak:keycloak-ldap-federation MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.0.2.final -...

org.keycloak:keycloak-dependencies-server-all (11.0.1), org.keycloak:keycloak-server-feature-pack (11.0.1) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (11.0.1)

org.keycloak:keycloak-ldap-federation MAVEN version 11.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 11.0.1 -...

org.keycloak:keycloak-dependencies-server-all (11.0.2), org.keycloak:keycloak-server-feature-pack (11.0.2) +3 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (11.0.2)

org.keycloak:keycloak-ldap-federation MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 11.0.2 -...

org.keycloak:keycloak-dependencies-server-all (11.0.3), org.keycloak:keycloak-server-feature-pack (11.0.3) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (11.0.3)

org.keycloak:keycloak-ldap-federation MAVEN version 11.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 11.0.3 -...

org.keycloak:keycloak-dependencies-server-all (6.0.0), org.keycloak:keycloak-server-feature-pack (6.0.0) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (6.0.0)

org.keycloak:keycloak-ldap-federation MAVEN version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 6.0.0 -...

org.keycloak:keycloak-dependencies-server-all (1.0-rc-2), org.keycloak:keycloak-server (1.0-rc-2) potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (1.0-rc-2)

org.keycloak:keycloak-ldap-federation MAVEN version 1.0-rc-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.0-rc-2 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.7), com.github.vzakharchenko:cisco-radius-plugin (1.3.7) +15 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (13.0.1)

org.keycloak:keycloak-ldap-federation MAVEN version 13.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.7 -...