CVE-2025-2559

Keycloak has a DoS vulnerability due to JWT token cache exhaustion when tokens have long expirations (e.g., 24–48 hours), causing the in-memory cache to grow and potentially run out of memory. Multiple connected sources confirm this as a cache exhaustion risk leading to denial of service. Red Hat...

CVE-2025-2559 Org.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak

A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This...

CVE-2025-2559

A flaw was found in Keycloak. When the configuration uses JWT tokens for authentication, the tokens are cached until expiration. If a client uses JWT tokens with an excessively long expiration time, for example, 24 or 48 hours, the cache can grow indefinitely, leading to an OutOfMemoryError. This...

Keycloak 安全漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. A security vulnerability exists in Keycloak versions 26.1.4 and earlier, which stems from a potentially infinite growth of the cache when using JWT tokens for authentication, potentially leading to a...

CVE-2023-6841 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2023-6841 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-W97F-W3HQ-36G2 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-W97F-W3HQ-36G2 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-GVGG-2R3R-53X7 Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims

This vulnerability is caused by the improper mapping of users to organizations based solely on email/username patterns. The issue is limited to the token claim level, meaning the user is not truly added to the organization but may appear as such in applications relying on these claims. The risk...

Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims

This vulnerability is caused by the improper mapping of users to organizations based solely on email/username patterns. The issue is limited to the token claim level, meaning the user is not truly added to the organization but may appear as such in applications relying on these claims. The risk...

GHSA-2P82-5WWR-43CW Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak

The issue arises because Keycloak does not perform an LDAP bind after a password reset, leading to potential authentication bypass for expired or disabled AD accounts. A fix should enforce LDAP validation after password updates to ensure consistency with AD authentication policies...

Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak

The issue arises because Keycloak does not perform an LDAP bind after a password reset, leading to potential authentication bypass for expired or disabled AD accounts. A fix should enforce LDAP validation after password updates to ensure consistency with AD authentication policies...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.10 Images Update

New images are available for Red Hat build of Keycloak 26.0.10 and Red Hat build of Keycloak 26.0.10 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

keycloak-ldap-federation: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak

A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...

keycloak-services: Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims

A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.10 Update

New Red Hat build of Keycloak 26.0.10 packages are available from the Customer Portal Red Hat build of Keycloak 26.0.10 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...

The vulnerability of the Proxy Header Handler component of the Keycloak identity and access management software allows a hacker to trigger a service failure.

The vulnerability of the Proxy Header Handler component of the Keycloak identity and access management software is related to shortcomings in HTTP request processing. Exploiting this vulnerability could allow a attacker to cause service failures...

The vulnerability of the SearchQueryUtils function in the software for managing identity and access control in Keycloak allows a hacker to trigger a service denial.

The vulnerability of the SearchQueryUtils function in the Keycloak identity and access management software relates to improper external control of the file name or path. Exploiting this vulnerability could allow a malicious actor to cause service failures...

GHSA-MQ23-VVG7-XFM4 Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login

Impact A vulnerability in Rancher has been discovered, leading to a local user impersonation through SAML Authentication on first login. The issue occurs when a SAML authentication provider AP is configured e.g. Keycloak. A newly created AP user can impersonate any user on Rancher by manipulating...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: nri-rabbitmq, kserve-modelmesh-serving, go-bindata, kubevela, kaniko, pluto, grafana-rollout-operator, litefs, cri-tools, kor, crossplane-provider-sql, gobuster, gitsign, emissary, spire-server, vault-k8s, nri-discovery-kubernetes, ctop, kuberay-operator, trillian,...