Product by Keycloak

    Keycloak

    20 known vulnerabilities in Keycloak (Keycloak), 0 of them actively exploited (CISA KEV).

    Key figures

    20

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Keycloak (Keycloak)
    HighCVE-2017-12159

    Red Hat Keycloak: Insufficient Session Expiration

    also in 2 other products

    		7.5
    HighCVE-2014-3651

    Keycloak: Denial of Service

    		7.5
    HighCVE-2017-12161

    Red Hat Keycloak: Client-Side Enforcement of Server-Side Security

    also in 1 other product

    		8.8
    HighCVE-2026-1609

    Keycloak: Improper Access Control

    also in 4 other products

    		8.1
    HighCVE-2026-90997

    Keycloak: Authentication Bypass by Capture-replay

    also in 2 other products

    		7.4
    HighCVE-2014-3709

    Keycloak: Cross-Site Request Forgery (CSRF)

    		8.8
    MediumCVE-2017-12158

    Red Hat Keycloak: HTTP Request/Response Smuggling

    also in 2 other products

    		5.4
    MediumCVE-2025-13467

    Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation

    also in 4 other products

    		5.5
    MediumCVE-2025-11538

    Keycloak-server: debug default bind address

    also in 2 other products

    		6.8
    MediumCVE-2025-8419

    Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

    also in 4 other products

    		5.3
    MediumCVE-2025-9162

    Org.keycloak/keycloak-model-storage-service: variable injection into environment variables

    also in 2 other products

    		4.9
    MediumCVE-2019-14820

    Keycloak: Exposure of Sensitive Information to an Unauthorized Actor

    also in 4 other products

    		4.3
    MediumCVE-2025-12110

    Keycloak: Insufficient Session Expiration

    also in 4 other products

    		5.4
    MediumCVE-2025-12390

    Keycloak: Session Fixation

    also in 4 other products

    		6.0
    MediumCVE-2020-10686

    Keycloak: Improper Authorization

    also in 1 other product

    		4.1
    HighCVE-2019-14832

    keycloak REST API: Incorrect Authorization

    also in 2 other products

    		5.0
    MediumCVE-2025-11429

    Keycloak-server: too long and not settings compliant session

    also in 2 other products

    		5.4
    LowCVE-2025-10939

    Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console

    also in 2 other products

    		3.7
    MediumCVE-2025-10044

    Keycloak: keycloak error_description injection on error pages

    also in 2 other products

    		4.3
    LowCVE-2025-12150

    Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

    also in 6 other products

    		3.1

    All products by Keycloak