CVE-2026-15945

CVE-2026-15945 affects Keycloak server’s administrative API with Fine-Grained Admin Permissions (FGAP) v2 enabled. A delegated administrator can bypass access controls by performing a group search for a child group they can view, causing the system to return the full details of the parent group. ...

CVE-2026-15945 Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

CVE-2026-15945

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

CVE-2026-15945

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (26.7.3.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (26.7.3.0) +106 more potentially affected by CVE-2026-16072 via org.keycloak:keycloak-services (>=26.5.0, <=26.7.2)

org.keycloak:keycloak-services MAVEN version =26.5.0, =1.0.0, =1.0.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =0.1.1, =1.5.0, =1.3.1, =1.4.0 and more Source cves: CVE-2026-16072 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18602952https:...

Insertion of Sensitive Information Into Sent Data

Overview @keycloak/keycloak-admin-ui is a This project is the next generation of the Keycloak Admin UI. It is written with React and PatternFly 4 and uses Vite. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through...

Insertion of Sensitive Information Into Sent Data

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data through OrganizationInvitationResource.toRepresentation in...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +204 more potentially affected by CVE-2026-16093 via org.keycloak:keycloak-services (>=13.0.0, <=26.7.2)

org.keycloak:keycloak-services MAVEN version =13.0.0, =0.1.0, =3.1.13-jdk1.8, =16.0.0, =1.3.6, =1.3.6, =1.3.6, =1.3.6, =1.3.6, =1.3.6, =1.3.6, =1.3.6, =1.3.6, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-16093 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752079...

Reliance on Untrusted Inputs in a Security Decision

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the client authentication flow in the client...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +394 more potentially affected by CVE-2026-16093 via org.keycloak:keycloak-server-spi-private (>=13.0.0, <=26.7.2)

org.keycloak:keycloak-server-spi-private MAVEN version =13.0.0, =0.1.0, =0.11.0, =0.10.4, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.0.28 and more Source cves: CVE-2026-16093 Source advisory: SNYK:JAVA-ORGKEYCLOAK-19477241...

Reliance on Untrusted Inputs in a Security Decision

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the client authentication flow in the...

Access Control Bypass

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Access Control Bypass through the Client-Initiated Backchannel Authentication token redemption handler in the...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +241 more potentially affected by CVE-2026-16103 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.5)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-16103 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752081...

Improper Validation of Consistency within Input

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input in the identity provider update flow for OIDC identity...

CVE-2026-1609

A flaw was found in Keycloak. When the JSON Web Token JWT authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper...

EUVD-2026-44841

A flaw was found in Keycloak. When the JSON Web Token JWT authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper...

CVE-2026-1609

CVE-2026-1609 affects Keycloak: when the JWT authorization grant preview feature is enabled and a user is disabled, Keycloak may not validate the user’s disabled status during JWT grant processing. A remote, low-privilege attacker can present an assertion token from an external IdP to obtain a JW...

CVE-2026-1609

A flaw was found in Keycloak. When the JSON Web Token JWT authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper...

CVE-2026-1609 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

A flaw was found in Keycloak. When the JSON Web Token JWT authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper...

CVE-2026-1609 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

A flaw was found in Keycloak. When the JSON Web Token JWT authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper...