de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0 <=5.5.1), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0) +26 more potentially affected by CVE-2025-11537 via org.keycloak:keycloak-quarkus-server (>=12.0.0 <=26.5.5)

org.keycloak:keycloak-quarkus-server MAVEN version =12.0.0, =2.5.6-24.0, =0.1.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.2.0, =26.2.0, =26.5.5 and more Source cves:...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0 <=5.4.3-26.2), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0) +21 more potentially affected by CVE-2026-0976 via org.keycloak:keycloak-quarkus-server (>=12.0.0 <=26.2.5)

org.keycloak:keycloak-quarkus-server MAVEN version =12.0.0, =2.5.6-24.0, =0.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.2.0, =26.2.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.2.5 and more Source cves: CVE-202...

Improper Validation of Syntactic Correctness of Input

Overview Affected versions of this package are vulnerable to Improper Validation of Syntactic Correctness of Input due to the improper validation of matrix parameters in URL paths in JAX-RS routing layer. An attacker can gain access to administrative or sensitive endpoints by crafting requests th...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=4.1.0-26.0 <=5.4.6), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=8.1 <=9.0) +24 more potentially affected by CVE-2026-0976 via org.keycloak:keycloak-quarkus-server (>=26.0.0 <=26.5.1)

org.keycloak:keycloak-quarkus-server MAVEN version =26.0.0, =4.1.0-26.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.2.0, =26.2.0, =26.1.0, =26...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0 <=5.4.6), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0) +25 more potentially affected by CVE-2025-10939 via org.keycloak:keycloak-quarkus-server (>=12.0.0 <=26.4.3)

org.keycloak:keycloak-quarkus-server MAVEN version =12.0.0, =2.5.6-24.0, =0.1.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.2.0, =26.2.0, =26.4.3 and more Source cves:...

org.keycloak.testframework:keycloak-test-framework-clustering (>=26.3.0 <=26.4.2), org.keycloak.testframework:keycloak-test-framework-core (>=26.1.0 <=26.4.2) +16 more potentially affected by CVE-2025-11538 via org.keycloak:keycloak-quarkus-dist (>=26.0.0 <=26.4.2)

org.keycloak:keycloak-quarkus-dist MAVEN version =26.0.0, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.2.0, =26.2.0, =26.1.0, =26.1.0, =26.1.0, =26.4.2...

Binding to an Unrestricted IP Address

Overview Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address due to the insecure default binding of the Java Debug Wire Protocol JDWP port to all network interfaces when debug mode is enabled. An attacker can gain unauthorized access to the Java virtual machi...

Uncontrolled Search Path Element

Overview Affected versions of this package are vulnerable to Uncontrolled Search Path Element via the /admin application path relative to /realms when accessed through a proxy that does not properly restrict or normalize URLs. An attacker can gain unauthorized access to sensitive administrative...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=4.1.0-26.0 <=5.4.3-26.2), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=8.1 <=8.9) +21 more potentially affected by CVE-2025-10939 via org.keycloak:keycloak-quarkus-server (>=26.0.0 <=26.3.5)

org.keycloak:keycloak-quarkus-server MAVEN version =26.0.0, =4.1.0-26.0, =8.1, =26.3.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.2.0, =26.2.0, =26.1.0, =26.1.0, =26.1.0, =26...

org.keycloak:keycloak-junit5 (>=21.1.0 <=26.0.1), org.keycloak:keycloak-quarkus-integration-tests (>=17.0.0 <=21.0.2) +1 more potentially affected by CVE-2025-11419 via org.keycloak:keycloak-quarkus-dist (>=17.0.0 <=26.0.1)

org.keycloak:keycloak-quarkus-dist MAVEN version =17.0.0, =21.1.0, =17.0.0, =26.0.0, =26.0.1 Source cves: CVE-2025-11419 Source advisory: OSV:GHSA-Q8HQ-4H99-FJ7X...

org.keycloak.testframework:keycloak-test-framework-clustering (>=26.3.0 <=26.4.0), org.keycloak.testframework:keycloak-test-framework-core (>=26.3.0 <=26.4.0) +14 more potentially affected by CVE-2025-11419 via org.keycloak:keycloak-quarkus-dist (>=26.3.0 <=26.4.0)

org.keycloak:keycloak-quarkus-dist MAVEN version =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.3.0, =26.4.0 and more Source cves: CVE-2025-11419https://...

org.keycloak.testframework:keycloak-test-framework-core (>=26.1.0 <=26.2.1), org.keycloak.testframework:keycloak-test-framework-db-mariadb (>=26.1.0 <=26.2.1) +12 more potentially affected by CVE-2025-11419 via org.keycloak:keycloak-quarkus-dist (>=26.1.0 <=26.2.1)

org.keycloak:keycloak-quarkus-dist MAVEN version =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.2.0, =26.2.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.2.1 Source cves: CVE-2025-11419 Source advisory: OSV:GHSA-Q8HQ-4H99-FJ7Xhttps://vulners.com...

org.keycloak.testframework:keycloak-test-framework-clustering (=26.4.0), org.keycloak.testframework:keycloak-test-framework-core (=26.4.0) +14 more potentially affected by CVE-2025-11419 via org.keycloak:keycloak-quarkus-dist (=26.4.0)

org.keycloak:keycloak-quarkus-dist MAVEN version =26.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-quarkus-dist and may be impacted: - org.keycloak.testframework:keycloak-test-framework-clustering =26.4.0 -...

org.keycloak.testframework:keycloak-test-framework-core (>=26.1.0 <=26.2.1), org.keycloak.testframework:keycloak-test-framework-db-mariadb (>=26.1.0 <=26.2.1) +12 more potentially affected by CVE-2025-11419 via org.keycloak:keycloak-quarkus-dist (>=26.1.0 <=26.2.1)

org.keycloak:keycloak-quarkus-dist MAVEN version =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.2.0, =26.2.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.2.1 Source cves: CVE-2025-11419 Source advisory: SNYK:JAVA-ORGKEYCLOAK-13517527https://vuln...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0 <=4.0.5-25.0), org.keycloak:keycloak-guides (>=25.0.0 <=26.0.5) +6 more potentially affected by CVE-2024-10973 via org.keycloak:keycloak-quarkus-server (>=25.0.0 <=26.0.5)

org.keycloak:keycloak-quarkus-server MAVEN version =25.0.0, =3.0.1-25.0, =25.0.0, =25.0.0, =25.0.0, =26.0.0, =25.0.0, =25.0.0, =26.0.0, =26.0.5 Source cves: CVE-2024-10973 Source advisory: OSV:GHSA-G6QQ-C9F9-2772...

GHSA-G6QQ-C9F9-2772 Keycloak on Quarkus CLI option for encrypted JGroups ignored

The env option KCCACHEEMBEDDEDMTLSENABLED does not work and the jgroups replication configuration is always used in plain. This option worked before in 24 and 22. More info in public issue https://github.com/keycloak/keycloak/issues/34644...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0 <=5.0.1-26.0), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0) +8 more potentially affected by CVE-2024-11736 via org.keycloak:keycloak-quarkus-server (>=12.0.0 <=26.0.7)

org.keycloak:keycloak-quarkus-server MAVEN version =12.0.0, =2.5.6-24.0, =0.1.0, =15.1.0, =15.1.0, =21.1.0, =26.0.0, =15.1.0, =12.0.0, =12.0.0, =26.0.0, =26.0.7 Source cves: CVE-2024-11736 Source advisory: OSV:GHSA-F4V7-3MWW-9GC2...

Unauthorized Access

org.keycloak, keycloak-quarkus-server is vulnerable to Unauthorized Access. The vulnerability is due to improper access controls, allowing a high-privileged user to read sensitive information from a Vault file outside the expected context...

Sensitive Data Exposure

org.keycloak, keycloak-quarkus-server is vulnerable to Sensitive Data Exposure. The vulnerability is due to the capture of sensitive runtime values, such as passwords, during the build process and their embedding as default values in bytecode, which allows an attacker to access sensitive data...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=4.1.0-26.0 <=5.5.1), net.optionfactory.keycloak:optionfactory-keycloak-providers (>=8.1 <=9.1) +24 more potentially affected by CVE-2024-9666 via org.keycloak:keycloak-quarkus-server (>=26.0.0 <=26.5.6)

org.keycloak:keycloak-quarkus-server MAVEN version =26.0.0, =4.1.0-26.0, =8.1, =26.3.0, =26.1.0, =26.4.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.1.0, =26.4.0, =26.1.0, =26.2.0, =26.2.0, =26.1.0, =26...