Product by Open Source
Keycloak
36 known vulnerabilities in Keycloak (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
36
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-18963 | Red Hat: Weak Password Recovery Mechanism for Forgotten Password | 9.1 | |
| Medium | CVE-2025-48924 | Apache Commons Lang: Uncontrolled Recursion | 5.3 | |
| High | CVE-2026-74909 | Red Hat: Missing Authorization | 8.1 | |
| High | CVE-2026-79651 | Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching | 7.5 | |
| High | CVE-2026-18212 | Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state | 7.5 | |
| High | CVE-2026-15572 | Red Hat build of Keycloak: Type Confusion | 8.8 | |
| High | CVE-2026-17526 | Red Hat: Missing Authorization | 7.2 | |
| Medium | CVE-2026-45292 | opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation | 5.3 | |
| High | CVE-2026-1609 | Keycloak: Improper Access Control | 8.1 | |
| Medium | CVE-2026-19607 | Keycloak-services: keycloak-services: broker-originated username collision causes account lockout | 5.3 | |
| High | CVE-2026-15573 | Red Hat: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | 8.1 | |
| High | CVE-2026-16102 | Red Hat: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | 8.1 | |
| High | CVE-2026-90997 | Keycloak: Authentication Bypass by Capture-replay | 7.4 | |
| High | CVE-2026-1486 | Red Hat build of Keycloak 26.4: Improperly Implemented Security Check for Standard | 8.8 | |
| Medium | CVE-2026-16100 | Red Hat: Allocation of Resources Without Limits or Throttling | 6.5 | |
| High | CVE-2026-15571 | Red Hat: Predictable from Observable State | 7.3 | |
| High | CVE-2026-1529 | Red Hat build of Keycloak: Improper Verification of Cryptographic Signature | 8.1 | |
| Medium | CVE-2025-67735 | Netty has a CRLF Injection vulnerability in io.netty.handler.codec.http.HttpRequestEncoder | 6.5 | |
| Critical | CVE-2026-16442 | Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction | 7.4 | |
| Medium | CVE-2026-59888 | jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy | 6.5 | |
| Medium | CVE-2026-79652 | Red Hat build of Keycloak 26.6: Missing Authorization | 5.9 | |
| Medium | CVE-2026-8830 | Red Hat build of Keycloak: Use of Client-Side Authentication | 4.3 | |
| Medium | CVE-2026-59889 | jackson-databind: @JsonView ypassed for @JsonUnwrapped container properties on deserialization | 6.5 | |
| Medium | CVE-2025-13467 | Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation | 5.5 | |
| Medium | CVE-2026-9087 | Red Hat build of Keycloak: Authorization Bypass Through User-Controlled Key | 6.4 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,
- NCSC-2026-0326 [1.00] [M/H] Kwetsbaarheden verholpen in Keycloakncsc-nl,
- Credential Management: N-able Passportal Token Leak; Keycloak Password Reset Flaw; Australian Password Bookssans-newsbites-mail,
- Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Accountthehackernews,