Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-core is an open source identity and access management solution. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key validation in the user property mapper handling for ClientRegistrationAuth and related DCR token...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +185 more potentially affected by CVE-2026-16100 via org.keycloak:keycloak-server-spi-private (>=26.0.0, <=26.7.0)

org.keycloak:keycloak-server-spi-private MAVEN version =26.0.0, =1.0.0, =1.0.0, =1.2.0, =1.1.0, =1.0.1, =1.1.0, =1.2.0 - com.nomendi6.orgsec:orgsec-keycloak-mapper 1.0.0 and more Source cves: CVE-2026-16100 Source advisory: SNYK:JAVA-ORGKEYCLOAK-19233604...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +101 more potentially affected by CVE-2026-15572 via org.keycloak:keycloak-services (>=26.0.0, <=26.4.7)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =1.1.1-26.0, =0.1.0, =1.4.0 and more Source cves: CVE-2026-15572 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752041...

Allocation of Resources Without Limits or Throttling

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through account and client error reporting in the...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in LDAPStorageProvider.searchLDAPByAttributes through LDAPENTRYDN lookups in federation/ldap/src/main/java/org/keycloak/storage/ldap/LDAPStorageProvider.java. A delegated administrator can retrieve and import...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.boozallen.aissemble:extensions-authzforce (>=1.13.0-rc6, <=2.0.0) +201 more potentially affected by CVE-2026-16102 via org.keycloak:keycloak-core (>=26.0.0, <=26.7.0)

org.keycloak:keycloak-core MAVEN version =26.0.0, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =2.0.0 - com.caputchin:caputchin-keycloak 0.2.0 - com.github.vzakharchenko:mikrotik-radius-plugin 1.6.1 - com.github.vzakharchenko:proxy-radius-plugin 1.6.1 -...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key validation in the user property mapper handling for...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through account and client error reporting in the user-event metrics component. An authenticated user can trigger the flaw by sending requests that produce failed account operations...

Origin Validation Error

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Origin Validation Error in the IdP-initiated broker endpoint. An attacker who controls a linked upstream SAML...

com.inventage.keycloak.log-level:keycloak-log-level (1.0.0), com.kleegroup.accelerator:accelerator-message-keycloakbrevo (1.2.0) +77 more potentially affected by CVE-2026-15572 via org.keycloak:keycloak-services (>=26.6.0, <=26.6.4)

org.keycloak:keycloak-services MAVEN version =26.6.0, =5.6.0, =5.6.0, =2.8.0, =2.2.0, =0.6.3, =2.1.0, =1.11.25, =1.2.0, =26.3.0-kc26.5.0, =26.4.3-kc26.6.3 and more Source cves: CVE-2026-15572 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752041...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=4.1.0-26.0, <=6.1.1), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=8.1, <=9.9) +28 more potentially affected by CVE-2026-16100 via org.keycloak:keycloak-quarkus-server (>=26.0.0, <=26.7.0)

org.keycloak:keycloak-quarkus-server MAVEN version =26.0.0, =4.1.0-26.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.6.0, =26.2.0, =26.2.0, =26...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the PathMatcher class in...

PT-2026-68175

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An issue exists in the Authorization Services of Keycloak. The PathMatcher component, which matches request paths to security policies, fails to properly normalize URIs before comparison. An...

PT-2026-68178

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Dynamic Client Registration DCR component of Keycloak. The default DCR policy does not properly validate the claim path for User Property mappers, which enables the...

CVE-2026-16442: Origin Validation Error

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

Keycloak -- multiple vulnerabilities

The Keycloak Team reports: CVE-2026-9793: JWE request object bypasses requestObjectSignatureAlg enforcement CVE-2026-4629: Privilege escalation via hardcoded role mapper injection in manage-clients CVE-2026-14209: Keycloak Admin UI Extension brute-force-user User Disclosure via search=id: under...

CVE-2026-16100: Allocation of Resources Without Limits or Throttling

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

CVE-2026-16102: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

PT-2026-68177

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the user-event metrics recording process. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Since...

PT-2026-68169

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the SAML metadata import functionality of the keycloak-services component, which serves as the core engine for identity brokering. When identity provider...