BIT-KEYCLOAK-2026-16072 Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

A flaw was found in the organization management component of Keycloak. A delegated administrator with permission to manage organizations can create an invitation for a non-existent email address and then retrieve the secret registration link directly through the application programming interface...

CVE-2026-55857 vulnerabilities

Vulnerabilities for packages: flyway, camunda-zeebe, zipkin, metabase, keycloak, airbyte-platform-fips, keycloak-fips, request-9047-keycloak-fips, airbyte-platform, debezium, flyway-fips, reposilite, camunda...

GHSA-QXVW-FVWX-5CP7 vulnerabilities

Vulnerabilities for packages: flyway, camunda-zeebe, zipkin, metabase, keycloak, airbyte-platform-fips, keycloak-fips, request-9047-keycloak-fips, airbyte-platform, debezium, flyway-fips, reposilite, camunda...

CVE-2026-55858 vulnerabilities

Vulnerabilities for packages: flyway, camunda-zeebe, zipkin, metabase, keycloak, airbyte-platform-fips, keycloak-fips, request-9047-keycloak-fips, airbyte-platform, debezium, flyway-fips, reposilite, camunda...

CVE-2026-55856 vulnerabilities

Vulnerabilities for packages: flyway, camunda-zeebe, zipkin, metabase, keycloak, airbyte-platform-fips, keycloak-fips, request-9047-keycloak-fips, airbyte-platform, debezium, flyway-fips, reposilite, camunda...

GHSA-XVR9-35CR-46V9 vulnerabilities

Vulnerabilities for packages: flyway, camunda-zeebe, zipkin, metabase, keycloak, airbyte-platform-fips, keycloak-fips, request-9047-keycloak-fips, airbyte-platform, debezium, flyway-fips, reposilite, camunda...

GHSA-G9JJ-CGMH-9F38 vulnerabilities

Vulnerabilities for packages: flyway, camunda-zeebe, zipkin, metabase, keycloak, airbyte-platform-fips, keycloak-fips, request-9047-keycloak-fips, airbyte-platform, debezium, flyway-fips, reposilite, camunda...

CVE-2026-82461

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82461

pac4j-oidc versions before 6.5.6 fail to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles via the KeycloakRolesAuthorizationGenerator component. Attackers with low privileges can forge access tokens containing administrative roles paire...

CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

CVE-2026-82461 pac4j-oidc before 6.5.6 Privilege Escalation via Unverified Keycloak Access Token

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

EUVD-2026-68118

pac4j-oidc before 6.5.6 fails to verify access token signatures, issuers, audiences, or expiry when extracting Keycloak realm and client roles. Attackers can forge access tokens with administrative roles paired with valid ID tokens to bypass authorization checks in applications relying on pac4j...

Authentication Bypass

Red Hat Build of Keycloak keycloak-services is vulnerable to an authentication bypass. The vulnerability is due to improper validation in the reset-credentials flow, which allows an unauthenticated attacker to bypass the required email verification step and directly set new credentials...

The vulnerability of the keycloak-services component of the Keycloak identity and access management software allows a perpetrator to bypass existing security mechanisms and gain unauthorized access to the system.

The vulnerability of the keycloak-services component of the Keycloak identity and access management software is related to the lack of a password recovery mechanism. Exploiting this vulnerability could allow an attacker to bypass existing security measures and gain unauthorized access to the syst...

Vulnerabilities hidden within Keycloak

Red Hat has addressed several vulnerabilities in Keycloak. The vulnerability with CVE-2026-18963 allows an unauthorized external attacker to force a password reset for any user account, thereby enabling them to take control of that account. This vulnerability exposes the email verification proces...

BIT-KEYCLOAK-2026-17048 Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

A flaw was found in the Keycloak Admin REST API, which is used to manage security realms and clients. The issue occurs when the system processes requests for rotated client secrets that are stored in a secure vault. Due to improper boundary enforcement, a delegated administrator with view-only...

BIT-KEYCLOAK-2026-15945 Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2

A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions FGAP v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to see. By searching for a child group the...

BIT-KEYCLOAK-2026-14613 Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions FGAP v2 are turned on, an administrator who is allowed to see a specific "role" can...

BIT-KEYCLOAK-2024-4629 Keycloak: potential bypass of brute force protection

A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously, attackers can exceed the configured limits for failed attempts before the system locks them out. Thi...

BIT-KEYCLOAK-2026-9800 Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access UMA permission checks. By including the configured access-denied page path within a request URL, either as a path...