Keycloak < 26.4.11 Multiple Vulnerabilities

Keycloak versions installed prior to 26.4.11 are affected by multiple vulnerabilities: - A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an...

CVE-2026-3429 vulnerabilities

Vulnerabilities for packages: keycloak...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.10), com.github.vzakharchenko:cisco-radius-plugin (1.4.10) +25 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (20.0.3)

org.keycloak:keycloak-services MAVEN version 20.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.10 -...

de.adorsys.sts:keycloak-storage-provider (>=1.2.0, <=1.2.4), net.optionfactory.keycloak:optionfactory-keycloak-apple-identity-provider (>=6.5, <=6.9) +23 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (25.0.2)

org.keycloak:keycloak-services MAVEN version 25.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =1.2.0, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5, =6.5,...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.11), com.github.vzakharchenko:cisco-radius-plugin (1.4.11) +22 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (21.0.0)

org.keycloak:keycloak-services MAVEN version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.11 -...

de.adorsys.multibanking:keycloak-custom-secret-provider (>=1.3.0, <=1.20), org.keycloak:keycloak-authz-policy-drools (3.1.0.final) +5 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (3.1.0.final)

org.keycloak:keycloak-services MAVEN version 3.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.multibanking:keycloak-custom-secret-provider =1.3.0, =1.20 -...

dk.grinn.keycloak:keycloak-migrate-resource (11.0.3.0), dk.grinn.keycloak:keycloak-migrate-spi (11.0.3.0) +10 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (11.0.3)

org.keycloak:keycloak-services MAVEN version 11.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - dk.grinn.keycloak:keycloak-migrate-resource 11.0.3.0 - dk.grinn.keycloak:keycloak-migrate-spi...

de.adorsys.sts:keycloak-storage-provider (0.29.0), dk.grinn.keycloak:keycloak-migrate-resource (0.0.5) +10 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (5.0.0)

org.keycloak:keycloak-services MAVEN version 5.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider 0.29.0 - dk.grinn.keycloak:keycloak-migrate-resource 0.0.5...

org.keycloak:keycloak-dependencies-server-all (1.9.4.final), org.keycloak:keycloak-dependencies-server-min (1.9.4.final) +2 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (1.9.4.final)

org.keycloak:keycloak-services MAVEN version 1.9.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 1.9.4.final -...

de.adorsys.keycloak:keycloak-clientregistration-provider (>=1.2, <=3.0), de.adorsys.keycloak:keycloak-provider-extension (>=1.2, <=3.0) +8 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (3.4.3.final)

org.keycloak:keycloak-services MAVEN version 3.4.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.keycloak:keycloak-clientregistration-provider =1.2, =1.2, =0.0.1, =0.0.1, =0.0.1,...

org.keycloak:keycloak-account-freemarker (1.0-beta-1-20150521), org.keycloak:keycloak-login-freemarker (1.0-beta-1-20150521) +1 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (1.0-beta-1-20150521)

org.keycloak:keycloak-services MAVEN version 1.0-beta-1-20150521 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-1-20150521 -...

com.charlyghislain.keycloak:keycloak-importexport (>=11.0.1, <=11.0.2), fr.cnieg.keycloak:attribute-login-provider (>=1.1.0, <=1.2.4) +9 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (11.0.2)

org.keycloak:keycloak-services MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.charlyghislain.keycloak:keycloak-importexport =11.0.1, =1.1.0, =1.2.4 -...

com.github.vzakharchenko:keycloak-plugins (1.0.2), com.github.vzakharchenko:mikrotik-radius-plugin (1.0.2) +12 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (8.0.2)

org.keycloak:keycloak-services MAVEN version 8.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:keycloak-plugins 1.0.2 - com.github.vzakharchenko:mikrotik-radius-plugin...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.6), com.github.vzakharchenko:cisco-radius-plugin (1.4.6) +31 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (18.0.2)

org.keycloak:keycloak-services MAVEN version 18.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.6 -...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.5.6-24.0, <=2.7.4-24.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0, <=2.7.4-24.0) +24 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (24.0.2)

org.keycloak:keycloak-services MAVEN version 24.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.5.6-24.0, =2.5.6-24.0, =0.4, =0.6 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.3.3), com.github.vzakharchenko:cisco-radius-plugin (1.3.3) +23 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (12.0.2)

org.keycloak:keycloak-services MAVEN version 12.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.3.3 -...

org.keycloak:keycloak-authz-policy-drools (2.1.0.cr1), org.keycloak:keycloak-dependencies-server-all (2.1.0.cr1) +3 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (2.1.0.cr1)

org.keycloak:keycloak-services MAVEN version 2.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 2.1.0.cr1 -...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.2.9, <=1.3.0), com.github.vzakharchenko:cisco-radius-plugin (>=1.2.9, <=1.3.0) +21 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (12.0.0)

org.keycloak:keycloak-services MAVEN version 12.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9, =1.2.9,...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.caputchin:caputchin-keycloak (0.2.0) +112 more potentially affected by CVE-2026-3429 via org.keycloak:keycloak-services (>=26.0.0, <=26.5.6)

org.keycloak:keycloak-services MAVEN version =26.0.0, =1.0.0, =1.2.0, =1.1.0, =1.0.1, =1.1.0, =1.0.0, =4.1.0-26.0, =4.1.0-26.0, =2.0.0-26.0, =2.6.0 and more Source cves: CVE-2026-3429 Source advisory: SNYK:JAVA-ORGKEYCLOAK-15426479https://vulners.com/snyk/SNYK:JAVA-ORGKEYCLOAK-1542647...