CVE-2026-18218

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

CVE-2026-18218 Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application client using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older,...

CVE-2026-50559 vulnerabilities

Vulnerabilities for packages: apicurio-registry, hono, request-9047-keycloak-fips, floci-az, keycloak-fips...

GHSA-QCXP-GM7M-4J5V vulnerabilities

Vulnerabilities for packages: apicurio-registry, hono, request-9047-keycloak-fips, floci-az, keycloak-fips...

PT-2026-66727

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description Keycloak allows authentication via Google accounts and can be restricted to specific Google Workspace domains. A flaw exists in the token exchange feature, which enables the swapping of a...

PT-2026-66870

Name of the Vulnerable Software and Affected Versions GeoNetwork versions 3.12.0 through 4.2.15 GeoNetwork versions 4.4.0 through 4.4.10 Description Unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter allows an attacker to redirect...

PT-2026-66722

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the group policy evaluation logic of Keycloak. When a group policy is configured to extend permissions to child groups, the system employs a simple text-based prefix check t...

CLEANSTART-2026-KH48438 Security fixes in keycloak 26.5.7-r1

Package keycloak version 26.5.7-r1 fixes 24 vulnerabilities: CVE-2026-44893, CVE-2026-44249, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673...

CLEANSTART-2026-QW10501 Security fixes in keycloak 26.4.10-r0

Package keycloak version 26.4.10-r0 fixes 26 vulnerabilities: CVE-2026-42579, CVE-2026-42587, CVE-2026-42583, CVE-2026-42584, CVE-2026-33871...

CLEANSTART-2026-WW01909 Security fixes in keycloak 26.3.5-r3

Package keycloak version 26.3.5-r3 fixes 24 vulnerabilities: CVE-2026-42583, CVE-2026-42579, CVE-2026-44893, CVE-2026-48059, CVE-2026-33870...

CLEANSTART-2026-SU06112 Security fixes in keycloak 26.6.3-r3

Package keycloak version 26.6.3-r3 fixes 13 vulnerabilities: CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516...

CLEANSTART-2026-BA48144 Security fixes in keycloak 26.5.7-r5

Package keycloak version 26.5.7-r5 fixes 11 vulnerabilities: CVE-2026-54291, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515...

CLEANSTART-2026-HT07249 Security fixes in keycloak 26.5.7-r0

Package keycloak version 26.5.7-r0 fixes 34 vulnerabilities: CVE-2025-11965, CVE-2025-11966, CVE-2025-59250, CVE-2026-0636, CVE-2026-5588...

CLEANSTART-2026-JZ16335 Security fixes in keycloak 26.6.4-r2

Package keycloak version 26.6.4-r2 fixes 4 vulnerabilities: ghsa-r7wm-3cxj-wff9, CVE-2026-55851, CVE-2026-59919, CVE-2026-55831...

CLEANSTART-2026-TO43731 Security fixes in keycloak 26.4.7-r7

Package keycloak version 26.4.7-r7 fixes 2 vulnerabilities: CVE-2026-40984, CVE-2026-50559...

CVE-2026-18201

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

CVE-2026-18207

A flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a...

CVE-2026-18201 Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

CVE-2026-18201

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...

CVE-2026-18201 Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that...