CVE-2026-1609 Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

A flaw was found in Keycloak. When the JSON Web Token JWT authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper...

com.inventage.keycloak.sms-authenticator:keycloak-sms-authenticator (>=1.2.0, <=1.3.0), de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=5.5.0, <=5.5.1) +66 more potentially affected by CVE-2026-1609 via org.keycloak:keycloak-services (>=26.5.0, <=26.5.2)

org.keycloak:keycloak-services MAVEN version =26.5.0, =1.2.0, =5.5.0, =5.5.0, =2.4.5, =2.1.0, =1.5.0, =1.3.1, =1.11.17, =0.6.2, =0.51, =0.53, =0.125, =0.46, =0.60 - net.continuous-security-tools:spi 2.1.14 and more Source cves: CVE-2026-1609 Source advisory: MEND:CVE-2026-1609...

PT-2026-60351

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description An improper access control issue exists when the JSON Web Token JWT authorization grant preview feature is enabled. Keycloak fails to validate the disabled status of a user account during th...

PT-2026-60541

Name of the Vulnerable Software and Affected Versions Keycloak server affected versions not specified Description A flaw exists in the group search functionality of the administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access...

CVE-2026-1609: Improper Access Control

A flaw was found in Keycloak. When the JSON Web Token JWT authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper...

CVE-2026-15945: Authorization Bypass Through User-Controlled Key

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

leprikon (>=2.28.1, <=2.39.2), wirecloud (>=1.3.0, <=1.3.1) +1 more potentially affected by CVE-2026-105315 via django-haystack (2.7.0)

django-haystack PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on django-haystack and may be impacted: - leprikon =2.28.1, =1.3.0, =0.1.1, =0.4.5 Source cves: CVE-2026-105315 Source advisory: OSV:GHSA-R3HX-X5RH-P9VV...

Information Exposure

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Information Exposure through the AuthenticationManagementResource in...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +417 more potentially affected by CVE-2026-16104 via org.keycloak:keycloak-server-spi-private (>=2.4.0.cr1, <=26.7.2)

org.keycloak:keycloak-server-spi-private MAVEN version =2.4.0.cr1, =0.1.0, =0.11.0, =0.10.4, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.0.28 and more Source cves: CVE-2026-16104 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18751621...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +235 more potentially affected by CVE-2026-16104 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.2)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-16104 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18751620...

Information Exposure

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Information Exposure through the AuthenticationManagementResource in...

ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0, <=0.7.0), ch.nerdin.keycloak.extensions:avatar-extension (0.0.1) +234 more potentially affected by CVE-2026-16105 via org.keycloak:keycloak-services (>=1.0-alpha-1, <=26.7.0)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =0.1.0, =3.1.13-jdk1.8, =11.0.1, =1.2.6, =1.2.5, =0.1, =0.1, =1.0.1, =0.1, =1.0.1, =0.1, =1.2.0, =24.3.0.0, =26.7.3.0 and more Source cves: CVE-2026-16105 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752070...

Missing Authorization

Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization in the RoleContainerResource admin REST composite-role endpoints. A delegated...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization in the RoleContainerResource admin REST composite-role endpoints. A delegated...

Missing Authorization

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization in the admin REST API through the deleteComposites role-composite deletion path in...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +142 more potentially affected by CVE-2026-16106 via org.keycloak:keycloak-services (>=26.0.0, <=26.7.2)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.0.0, =1.0.0, =1.2.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =1.1.0 and more Source cves: CVE-2026-16106 Source advisory: SNYK:JAVA-ORGKEYCLOAK-18752075https://vulners.com/snyk/SNYK:JAVA-ORGKEYCLOAK-187...

Information Exposure

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Information Exposure due to insufficient group-permission filtering in RealmAdminResource.getRealm,...

Authorization Bypass Through User-Controlled Key

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the admin API’s group hierarchy search under FGAP v2...

Exploit for Insufficient Session Expiration in Apache Camel

camel-keycloak Missing ISACTIVE Check — Expired Tokens Accept...

apache-airflow-providers-keycloak: Missing OAuth 2.0 State and PKCE Enables Login CSRF and Session Fixation

The Keycloak authentication manager in apache-airflow-providers-keycloak did not generate or validate the OAuth 2.0 state parameter on the login / login-callback flow, and did not use PKCE. An attacker with a Keycloak account in the same realm could deliver a crafted callback URL to a victim's...