PT-2026-93784

Name of the Vulnerable Software and Affected Versions Jenkins Keycloak Authentication Plugin versions prior to 2.4.2 Description The plugin fails to restrict the redirect URL after the login process. This flaw allows attackers to redirect users to malicious sites, facilitating phishing attacks...

PT-2026-93821

Name of the Vulnerable Software and Affected Versions keycloak-services affected versions not specified Description A flaw exists in the first-broker-login flow of the keycloak-services component, which manages initial authentication and account linking for users logging in via external identity...

PT-2026-95069

Name of the Vulnerable Software and Affected Versions Keycloak versions 26.7.0 through 26.7.3 Description A flaw exists when the software is deployed in stateless mode using MySQL or MariaDB. A mismatch in row-count semantics between the database driver and the application logic allows the replay...

CVE-2026-19607: Improper Authentication

A flaw was found in the first-broker-login flow of the keycloak-services component. This component handles the initial authentication and account linking when a user logs in via an external identity provider. The issue allows an attacker to register a matching username on an external provider to...

CVE-2026-17526: Missing Authorization

Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability to manage users,...

CVE-2026-18212: Missing Release of Memory after Effective Lifetime

A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit...

CVE-2026-74909: Missing Authorization

Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directo...

CVE-2026-92141: URL Redirection to Untrusted Site

Jenkins Keycloak Authentication Plugin 2.4.1 and earlier does not restrict the redirect URL after login, allowing attackers to perform phishing attacks...

CVE-2026-92358: Insufficient Session Expiration

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

PT-2026-93317

A flaw was found in the first broker login flow of Keycloak. When a user confirms an account-linking request from a different browser, a temporary proof is created to validate the link. However, this proof is not properly cleared after the link is established or when the user later manually remov...

PT-2026-93413

Name of the Vulnerable Software and Affected Versions Apache Airflow Keycloak provider versions 3.3 and later Description The Keycloak auth manager retrieves a user's identity from a signed Airflow session token but obtains Keycloak access and refresh tokens from separate, unauthenticated cookies...

PT-2026-93791

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the policy enforcer used to protect applications by matching incoming web requests against security policies. The enforcer fails to correctly normalize web addresses...

PT-2026-93820

Name of the Vulnerable Software and Affected Versions Keycloak versions prior to 26.7.4 Description A flaw exists where a user assigned the impersonation role can impersonate a realm administrator. This privilege escalation allows an attacker to obtain full administrative control over the realm,...

CVE-2026-76186: Reliance on Cookies without Validation and Integrity Checking

Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token but takes the Keycloak access and refresh tokens used for every authorization decision from separate, unauthenticated cookies, and never checks that the two...

CVE-2026-76187: Improper Authentication

Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, not only the client configured for Airflow. No allowlist restricts which client ids may authenticate, so the credentials of an...

PT-2026-93787

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the SAML Redirect Binding implementation of Keycloak. The issue stems from custom DEFLATE compression and decompression helpers that fail to release native zlib memory after...

PT-2026-93414

Name of the Vulnerable Software and Affected Versions apache-airflow-providers-keycloak versions prior to 0.10.0 Description The unauthenticated token endpoint accepts a client-credentials grant for any confidential client registered in the Keycloak realm, rather than restricting it to the client...

PT-2026-93803

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the theme localization endpoints of the keycloak-services component, which manages authentication flows and themes. The system accepts arbitrary locale tags from...

Open redirect vulnerability in keycloak

keycloak 2.4.1 and earlier does not restrict the redirect URL after login. This allows attackers to perform phishing attacks by having users go to a Jenkins URL that will forward them to a different site after successful authentication. keycloak 2.4.2 only redirects to relative Jenkins URLs...

CVE-2026-79651: Uncontrolled Resource Consumption

A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them...