Keycloak vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
82 matching records
- Medium4.2A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution.Check if you run itEPSS 0.16%Oct 21, 2026
- MediumApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement tokenCheck if you run itEPSS 0.37%Oct 15, 2026
- UnknownThe Apache Airflow Keycloak provider's multi-team provisioning ( ) granted every team role global read access to audit logs.Check if you run itEPSS 0.26%Oct 15, 2026
- Medium6.8A flaw was found in the Client-Initiated Backchannel Authentication CIBA implementation within the keycloak-services component of Keycloak.Check if you run itEPSS 0.25%Oct 12, 2026
- Medium4.6Keycloak allows unauthorized access to resources via uma permission ticket bypassCheck if you run itEPSS 0.29%Aug 25, 2026
- Medium6.5Keycloak: Attacker can re-enable and take over disabled clients via registration access tokenCheck if you run itEPSS 0.46%Aug 25, 2026
- High7.3Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypassCheck if you run itEPSS 0.78%Aug 25, 2026
- Medium4.9Keycloak vulnerable to information disclosure through arbitrary filesystem path probingCheck if you run itEPSS 0.78%Aug 25, 2026
- UnknownRed Hat build_of_keycloak Weak Password Recovery Mechanism for Forgotten PasswordPatch nowKEVEPSS 4.68%Aug 25, 2026
- Medium6.5A flaw was found in Keycloak.Check if you run itEPSS 0.49%Jun 30, 2026
- Medium6.5Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access tokenOpen the advisoryJun 25, 2026
- High8.1A flaw was found in Keycloak Policy Enforcer.Check if you run itEPSS 0.65%Jun 25, 2026
- Medium5.3A flaw was found in Keycloak's ClientRegistrationAuth component.Check if you run itEPSS 0.42%May 28, 2026
- Medium6.8A flaw was found in Keycloak.Check if you run itEPSS 0.30%May 28, 2026
- Medium4.9A flaw was found in Keycloak.Check if you run itEPSS 0.48%May 28, 2026
- Medium4.3A flaw was found in Keycloak, an open-source identity and access management solution.Check if you run itEPSS 0.38%May 28, 2026
- Medium6.5A flaw was found in Keycloak.Check if you run itEPSS 0.22%May 28, 2026
- High7.3A flaw was found in Keycloak's Fine-Grained Admin Permissions (FGAPv2) feature.Check if you run itEPSS 0.35%May 28, 2026
- Medium5.3A flaw was found in Keycloak.Check if you run itEPSS 0.44%May 28, 2026
- High7.5A flaw was found in Keycloak.Check if you run itEPSS 0.16%May 28, 2026
- Medium6.5A flaw was found in Keycloak's Client Policies, specifically within the component.Check if you run itEPSS 0.27%May 28, 2026
- Medium4.3A flaw was found in Keycloak.Check if you run itEPSS 0.21%May 28, 2026
- High8.1A flaw was found in Keycloak.Check if you run itEPSS 0.31%May 20, 2026
- High7.1A flaw was found in Keycloak.Check if you run itEPSS 0.41%May 19, 2026
- High7.5A session fixation vulnerability was found in Keycloak's login-actions endpoints.Check if you run itEPSS 0.84%May 19, 2026