Authentication Bypass

Red Hat Build of Keycloak is vulnerable to an authentication bypass. The vulnerability is due to improper validation of cryptographic signatures when an OIDC identity provider is configured to skip signature validation, which allows an attacker with knowledge of specific session details to send a...

Improper Verification of Cryptographic Signature

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the backchannel logout endpoint of the keycloak-services...

CVE-2026-15943: Improper Validation of Consistency within Input

A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing...

Improper Validation of Consistency within Input

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input in the identity provider update flow for OIDC identity...