org.keycloak:keycloak-account-freemarker (1.5.0.final), org.keycloak:keycloak-broker-oidc (1.5.0.final) +8 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.5.0.final)

org.keycloak:keycloak-services MAVEN version 1.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.5.0.final - org.keycloak:keycloak-broker-oidc...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (>=1.1.0-beta.3, <=1.1.3.final), org.keycloak:keycloak-account-freemarker (1.3.1.final) +9 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.3.1.final)

org.keycloak:keycloak-services MAVEN version 1.3.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server =1.1.0-beta.3, =1.1.3.final -...

org.keycloak:keycloak-account-freemarker (1.7.0.cr1), org.keycloak:keycloak-broker-oidc (1.7.0.cr1) +9 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.7.0.cr1)

org.keycloak:keycloak-services MAVEN version 1.7.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.7.0.cr1 - org.keycloak:keycloak-broker-oidc 1.7.0.cr...

org.keycloak:keycloak-account-freemarker (1.8.0.alpha1), org.keycloak:keycloak-broker-oidc (1.8.0.alpha1) +9 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.8.0.alpha1)

org.keycloak:keycloak-services MAVEN version 1.8.0.alpha1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.alpha1 - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-account-freemarker (1.4.0.final), org.keycloak:keycloak-broker-oidc (1.4.0.final) +8 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.4.0.final)

org.keycloak:keycloak-services MAVEN version 1.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.4.0.final - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-account-freemarker (1.8.1.final), org.keycloak:keycloak-broker-oidc (1.8.1.final) +9 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.8.1.final)

org.keycloak:keycloak-services MAVEN version 1.8.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.1.final - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-account-freemarker (1.5.1.final), org.keycloak:keycloak-broker-oidc (1.5.1.final) +8 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.5.1.final)

org.keycloak:keycloak-services MAVEN version 1.5.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.5.1.final - org.keycloak:keycloak-broker-oidc...

org.keycloak:keycloak-account-freemarker (1.8.0.cr2), org.keycloak:keycloak-broker-oidc (1.8.0.cr2) +9 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.8.0.cr2)

org.keycloak:keycloak-services MAVEN version 1.8.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.cr2 - org.keycloak:keycloak-broker-oidc 1.8.0.cr...

org.keycloak:keycloak-account-freemarker (1.8.0.cr1), org.keycloak:keycloak-broker-oidc (1.8.0.cr1) +9 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.8.0.cr1)

org.keycloak:keycloak-services MAVEN version 1.8.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.cr1 - org.keycloak:keycloak-broker-oidc 1.8.0.cr...

EUVD-2026-9864

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language SAML client is configured as an Identity Provider IdP-initiated broker landing target, it can still complete the login process and establish a Single Sign-On SSO session. This allows a remote attacker...

org.keycloak:keycloak-account-freemarker (1.8.0.final), org.keycloak:keycloak-broker-oidc (1.8.0.final) +9 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.8.0.final)

org.keycloak:keycloak-services MAVEN version 1.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.8.0.final - org.keycloak:keycloak-broker-oidc...

Authentication Bypass by Primary Weakness

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness when a disabled SAML client is configured as an Identity Provider...

org.keycloak:keycloak-account-freemarker (1.2.0.cr1), org.keycloak:keycloak-broker-oidc (1.2.0.cr1) +8 more potentially affected by CVE-2026-3009 via org.keycloak:keycloak-services (1.2.0.cr1)

org.keycloak:keycloak-services MAVEN version 1.2.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.2.0.cr1 - org.keycloak:keycloak-broker-oidc 1.2.0.cr...

CVE-2026-20102

A vulnerability in the SAML 2.0 single sign-on SSO feature of Cisco Secure Firewall ASA Software and Cisco Secure Firewall Threat Defense FTD Software could allow an unauthenticated, remote attacker to conduct a cross-site scripting XSS attack against the SAML feature and access sensitive,...

CVE-2026-20101

A vulnerability in the SAML 2.0 single sign-on SSO feature of Cisco Secure Firewall ASA Software and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a DoS condition. This vulnerability is due to insufficient error checki...

org.keycloak/keycloak-services: Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language SAML setup, it fails to validate the NotOnOrAfter timestamp within the SubjectConfirmationData. This allows an attacker to delay the expiration of SAML...

keycloak: Keycloak: Denial of Service due to excessive SAMLRequest decompression

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service DoS by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryErro...

CVE-2026-3047

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language SAML client is configured as an Identity Provider IdP-initiated broker landing target, it can still complete the login process and establish a Single Sign-On SSO session. This allows a remote attacker...

CVE-2026-3047 Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language SAML client is configured as an Identity Provider IdP-initiated broker landing target, it can still complete the login process and establish a Single Sign-On SSO session. This allows a remote attacker...

CVE-2026-3047

A flaw in Keycloak’s SAML broker (org.keycloak.broker.saml) allows a disabled SAML client, when configured as an IdP-initiated broker landing target, to complete the login flow and establish an SSO session. This can let a remote attacker access other enabled clients without re-authenticating, eff...