BIT-KEYCLOAK-2024-7260 Keycloak-core: open redirect on account page

An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referreruri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.boozallen.aissemble:extensions-authzforce (>=1.13.0-rc6, <=2.0.0) +201 more potentially affected by CVE-2026-16102 via org.keycloak:keycloak-core (>=26.0.0, <=26.7.0)

org.keycloak:keycloak-core MAVEN version =26.0.0, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =2.0.0 - com.caputchin:caputchin-keycloak 0.2.0 - com.github.vzakharchenko:mikrotik-radius-plugin 1.6.1 - com.github.vzakharchenko:proxy-radius-plugin 1.6.1 -...

EUVD-2026-51483

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the...

CVE-2026-18211: Improper Input Validation

A flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the...

Improper Verification of Cryptographic Signature

Overview org.keycloak:keycloak-core is an open source identity and access management solution. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the JWT Authorization Grant flow due to algorithm confusion in signature verification. An attacke...

ch.nerdin.keycloak.extensions:avatar-extension (0.0.1), com.boozallen.aissemble:extensions-authzforce (>=1.13.0-rc6, <=2.0.0) +186 more potentially affected by CVE-2026-11800 via org.keycloak:keycloak-core (>=26.0.0, <=26.6.3)

org.keycloak:keycloak-core MAVEN version =26.0.0, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.13.0-rc6, =1.0.0, =1.2.0 and more Source cves: CVE-2026-11800 Source advisory: SNYK:JAVA-ORGKEYCLOAK-17660979...

com.avast.grpc.jwt:grpc-java-jwt-keycloak (0.5.9), com.ritense.valtimo:keycloak-iam (>=9.26.1.release, <=9.26.2.release) +76 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (20.0.2)

org.keycloak:keycloak-core MAVEN version 20.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.avast.grpc.jwt:grpc-java-jwt-keycloak 0.5.9 - com.ritense.valtimo:keycloak-iam =9.26.1.release, =2.0.5...

de.arbeitsagentur.opdt:keycloak-cassandra-extension (>=2.5.3-23.0, <=2.5.5-23.0), de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.3-23.0, <=2.5.5-23.0) +108 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (23.0.7)

org.keycloak:keycloak-core MAVEN version 23.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-extension =2.5.3-23.0, =2.5.3-23.0, =1.1.7, =0.2.7.final,...

org.keycloak:keycloak-adapter-core (3.3.0.cr2), org.keycloak:keycloak-admin-client (3.3.0.cr2) +56 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (3.3.0.cr2)

org.keycloak:keycloak-core MAVEN version 3.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-adapter-core 3.3.0.cr2 - org.keycloak:keycloak-admin-client 3.3.0.cr2 -...

com.abavilla:fpi-bot-api (>=1.5.1, <=1.5.4), com.abavilla:fpi-bot-api-parent (>=1.5.1, <=1.5.4) +125 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (21.0.1)

org.keycloak:keycloak-core MAVEN version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.abavilla:fpi-bot-api =1.5.1, =1.5.1, =1.7.0, =1.7.0, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22,...

cc.jstr:keycloak-authkit (>=1.0.0, <=1.0.1), com.avast.grpc.jwt:grpc-java-jwt-keycloak (0.5.1) +84 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (16.0.0)

org.keycloak:keycloak-core MAVEN version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - cc.jstr:keycloak-authkit =1.0.0, =1.0.1 - com.avast.grpc.jwt:grpc-java-jwt-keycloak 0.5.1 -...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.6.0), org.hawkular.accounts:hawkular-accounts (>=2.0.18.final, <=2.0.19.final) +89 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (1.8.0.final)

org.keycloak:keycloak-core MAVEN version 1.8.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.6.0 - org.hawkular.accounts:hawkular-accounts...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (>=0.2.1, <=0.3.0), org.keycloak:keycloak-account-api (1.5.0-final) +84 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (1.5.0-final)

org.keycloak:keycloak-core MAVEN version 1.5.0-final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard =0.2.1, =0.3.0 - org.keycloak:keycloak-account-api...

org.keycloak:keycloak-account-api (1.0-beta-1), org.keycloak:keycloak-account-freemarker (1.0-beta-1) +38 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (1.0-beta-1)

org.keycloak:keycloak-core MAVEN version 1.0-beta-1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0-beta-1 - org.keycloak:keycloak-account-freemarker 1.0-beta-1 -...

com.abavilla:fpi-bot-api (>=1.8.1, <=1.8.5), com.abavilla:fpi-bot-api-parent (>=1.8.1, <=1.8.5) +189 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (22.0.1)

org.keycloak:keycloak-core MAVEN version 22.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.abavilla:fpi-bot-api =1.8.1, =1.8.1, =1.8.6, =1.8.6, =1.9.0, =1.9.0, =1.10.1, =1.10.1, =1.0.29, =1.0.2...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.5), com.github.vzakharchenko:cisco-radius-plugin (1.4.5) +101 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (18.0.1)

org.keycloak:keycloak-core MAVEN version 18.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.5 - com.github.vzakharchenko:cisco-radius-plugin 1.4...

de.ahus1.keycloak.dropwizard:keycloak-dropwizard (0.9.1), org.keycloak:keycloak-adapter-core (2.5.4.final) +54 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (2.5.4.final)

org.keycloak:keycloak-core MAVEN version 2.5.4.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - de.ahus1.keycloak.dropwizard:keycloak-dropwizard 0.9.1 - org.keycloak:keycloak-adapter-core 2.5.4.fin...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.3.8, <=1.3.9), com.github.vzakharchenko:cisco-radius-plugin (>=1.3.8, <=1.3.9) +141 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (14.0.0)

org.keycloak:keycloak-core MAVEN version 14.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8, =1.3.8,...

org.jboss.aerogear.unifiedpush:unifiedpush-auth-server (1.0.1), org.jboss.aerogear.unifiedpush:unifiedpush-jaxrs (1.0.1) +50 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (1.0-final)

org.keycloak:keycloak-core MAVEN version 1.0-final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.jboss.aerogear.unifiedpush:unifiedpush-auth-server 1.0.1 -...

org.keycloak:keycloak-account-api (1.0-beta-1-20150521), org.keycloak:keycloak-account-freemarker (1.0-beta-1-20150521) +36 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (1.0-beta-1-20150521)

org.keycloak:keycloak-core MAVEN version 1.0-beta-1-20150521 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-core and may be impacted: - org.keycloak:keycloak-account-api 1.0-beta-1-20150521 -...