Keycloak security vulnerabilities
Open-source infrastructure. Public CVE monitoring for Keycloak. Vendor security advisories are linked on this page.
Built for Identity administrators.
82 public records · 0 security-fix timeline events. 0 published in the last 7 days. 42 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 1
- Medium 6
- Low 0
2026-08-047 issues2026-11-01
Known exploited
View all known exploitedRecently published
Browse catalog- Medium4.2A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution.Check if you run itEPSS 0.16%Oct 21, 2026
- MediumApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement tokenCheck if you run itEPSS 0.37%Oct 15, 2026
- Medium6.8A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak.Check if you run itEPSS 0.25%Oct 12, 2026
- Medium4.6Keycloak allows unauthorized access to resources via uma permission ticket bypassCheck if you run itEPSS 0.29%Aug 25, 2026
- Medium6.5Keycloak: Attacker can re-enable and take over disabled clients via registration access tokenCheck if you run itEPSS 0.46%Aug 25, 2026
- High7.3Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypassCheck if you run itEPSS 0.78%Aug 25, 2026
- Medium4.9Keycloak vulnerable to information disclosure through arbitrary filesystem path probingCheck if you run itEPSS 0.78%Aug 25, 2026
- Medium6.5A flaw was found in Keycloak.Check if you run itEPSS 0.49%Jun 30, 2026
- Medium6.5Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access tokenOpen the advisoryJun 25, 2026
- High8.1A flaw was found in Keycloak Policy Enforcer.Check if you run itEPSS 0.65%Jun 25, 2026