Access of Resource Using Incompatible Type ('Type Confusion')

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in ProtocolMappersClientRegistrationPolicy via th...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key validation in the user property mapper handling for...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through account and client error reporting in the user-event metrics component. An authenticated user can trigger the flaw by sending requests that produce failed account operations...

Origin Validation Error

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Origin Validation Error in the IdP-initiated broker endpoint. An attacker who controls a linked upstream SAML...

com.inventage.keycloak.log-level:keycloak-log-level (1.0.0), com.kleegroup.accelerator:accelerator-message-keycloakbrevo (1.2.0) +77 more potentially affected by CVE-2026-15572 via org.keycloak:keycloak-services (>=26.6.0, <=26.6.4)

org.keycloak:keycloak-services MAVEN version =26.6.0, =5.6.0, =5.6.0, =2.8.0, =2.2.0, =0.6.3, =2.1.0, =1.11.25, =1.2.0, =26.3.0-kc26.5.0, =26.4.3-kc26.6.3 and more Source cves: CVE-2026-15572 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752041...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=4.1.0-26.0, <=6.1.1), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=8.1, <=9.9) +28 more potentially affected by CVE-2026-16100 via org.keycloak:keycloak-quarkus-server (>=26.0.0, <=26.7.0)

org.keycloak:keycloak-quarkus-server MAVEN version =26.0.0, =4.1.0-26.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.6.0, =26.2.0, =26.2.0, =26...

Use of Non-Canonical URL Paths for Authorization Decisions

Overview org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions in the PathMatcher class in...

PT-2026-68175

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An issue exists in the Authorization Services of Keycloak. The PathMatcher component, which matches request paths to security policies, fails to properly normalize URIs before comparison. An...

PT-2026-68178

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Dynamic Client Registration DCR component of Keycloak. The default DCR policy does not properly validate the claim path for User Property mappers, which enables the...

CVE-2026-16442: Origin Validation Error

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with contr...

CVE-2026-16100: Allocation of Resources Without Limits or Throttling

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated...

CVE-2026-16102: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

A flaw was found in the Dynamic Client Registration DCR component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker...

PT-2026-68177

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the user-event metrics recording process. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Since...

PT-2026-68169

Name of the Vulnerable Software and Affected Versions Red Hat Build of Keycloak affected versions not specified Description A flaw exists in the SAML metadata import functionality of the keycloak-services component, which serves as the core engine for identity brokering. When identity provider...

CVE-2026-15572: Access of Resource Using Incompatible Type

A flaw was found in Keycloak's Dynamic Client Registration DCR security policy management. The "Allowed Protocol Mapper Types" policy, which restricts which types of data mappers a client can use, fails to re-validate the mapper type during a client update if the mapper's configuration remains...

PT-2026-68176

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the LDAP storage provider used to federate user identities from external directories. When a delegated administrator performs a search using a specific LDAP entry...

CVE-2026-16443: Improper Verification of Cryptographic Signature

A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables...

CVE-2026-16071: Improper Neutralization of Special Elements used in an LDAP Query

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name DN. Due to missing validation, the system allows lookups...

PT-2026-68183

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the SAML broker component used for identity federation and user authentication. The IdP-initiated Single Sign-On endpoint fails to verify if a provider is restricted to...

CVE-2026-15573: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies PathMatcher does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick th...