Keycloak security note

CVE-2026-9800 — Check if you run it

A flaw was found in Keycloak Policy Enforcer.

Affected < 26.0.10

CVE-2026-9086 — Check if you run it

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Affected < 26.6.4

CVE-2026-9083 — Check if you run it

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

Affected < 26.6.4

CVE-2026-9799 — Check if you run it

Keycloak allows unauthorized access to resources via uma permission ticket bypass

Affected < 26.6.4

CVE-2026-9705 — Check if you run it

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

Affected < 26.6.4

GHSA-q929-g23j-2rc7 — Open the advisory

Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token

Seen in 1.0-alpha-1 · 2 other packages on the advisory

CVE-2026-37982 — Check if you run it

A flaw was found in Keycloak.

Affected < 26.4.12

CVE-2026-37979 — Check if you run it

A flaw was found in Keycloak.

Affected < 26.4.12

CVE-2025-11537 — Check if you run it

A flaw was found in Keycloak.

No version range is stored, so an installed version cannot be checked.

CVE-2026-114438 — Check if you run it

A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution.

No version range is stored, so an installed version cannot be checked.

CVE-2024-1249 — Check if you run it

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages.

No version range is stored, so an installed version cannot be checked.