PT-2025-43517

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in Keycloak where an offline session remains valid even after the offline access scope is removed from the client. The refresh token continues to be accepted, allowing for the...

Red Hat build of Keycloak 代码问题漏洞

Red Hat build of Keycloak is a web application for single sign-on from Red Hat, Inc. A code issue vulnerability exists in the Red Hat build of Keycloak, which stems from an offline session remaining active after removing the client's offlineaccess scope, which could lead to an administrator...

PT-2025-43516

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A logic flaw exists in Keycloak’s session management. The software does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, cassandra, thingsboard, akhq, apache-nifi-registry, management-api-for-apache-cassandra-5.0, apache-nifi, kserve-modelmesh, nextflow, dependency-track, trino, sonar-scanner-cli, cassandra-reaper, zookeeper...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: keycloak-config-cli, cassandra, thingsboard, akhq, apache-nifi-registry, management-api-for-apache-cassandra-5.0, apache-nifi, kserve-modelmesh, nextflow, dependency-track, trino, sonar-scanner-cli, cassandra-reaper, zookeeper...

CVE-2025-11226 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, kayenta, akhq, cassandra-fips, kserve-modelmesh, localstack, trino, apache-nifi, keycloak-config-cli, knative-kafka-broker-fips, cassandra, management-api-for-apache-cassandra-4.1, thingsboard, zookeeper, ontop, zookeeper-fips, sonar-scanner-cli...

GHSA-25QH-J22F-PWP8 vulnerabilities

Vulnerabilities for packages: apache-nifi-registry, kayenta, akhq, cassandra-fips, kserve-modelmesh, localstack, trino, apache-nifi, keycloak-config-cli, knative-kafka-broker-fips, cassandra, management-api-for-apache-cassandra-4.1, thingsboard, zookeeper, ontop, zookeeper-fips, sonar-scanner-cli...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.10 Security Update

New Red Hat build of Keycloak 26.2.10 packages are available from the Customer Portal Red Hat build of Keycloak 26.2.10 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

keycloak: Keycloak TLS Client-Initiated Renegotiation Denial of Service

A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.10 Images Security Update

New images are available for Red Hat build of Keycloak 26.2.10 and Red Hat build of Keycloak 26.2.10 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

GHSA-27GC-WJ6X-9W55 Keycloak error_description injection on error pages that can trigger phishing attacks

Keycloak’s account console accepts arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages e.g., fake support phone numbers or...

EUVD-2025-27029

Keycloak errordescription injection on error pages that can trigger phishing attacks...

Keycloak error_description injection on error pages that can trigger phishing attacks

Keycloak’s account console accepts arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages e.g., fake support phone numbers or...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.16 Update

New Red Hat build of Keycloak 26.0.16 packages are available from the Customer Portal Red Hat build of Keycloak 26.0.16 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.16 Images Update

New images are available for Red Hat build of Keycloak 26.0.16 and Red Hat build of Keycloak 26.0.16 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

keycloak: Keycloak TLS Client-Initiated Renegotiation Denial of Service

A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable...

Exploit for Server-Side Request Forgery in Apache Kafka

Apache Kafka 4.1.0 with Keycloak OAuth2 Authentication Produc...

EUVD-2025-25456

Keycloak Potential Variable Reference in Model Storage Services...

GHSA-8HXP-QMPH-W5GQ Keycloak Potential Variable Reference in Model Storage Services

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...

Keycloak Potential Variable Reference in Model Storage Services

A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...