Product by Red Hat
Keycloak
149 known vulnerabilities in Keycloak (Red Hat), 0 of them actively exploited (CISA KEV).
Key figures
149
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
5
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-18963 | Red Hat: Weak Password Recovery Mechanism for Forgotten Password | 9.1 | |
| High | CVE-2024-3656 | Keycloak: Exposure of Sensitive Information to an Unauthorized Actor | 8.1 | |
| Medium | CVE-2025-48924 | Apache Commons Lang: Uncontrolled Recursion | 5.3 | |
| High | CVE-2024-8698 | Keycloak: Improper Verification of Cryptographic Signature | 7.7 | |
| High | CVE-2020-1714 | Red Hat Keycloak: Improper Input Validation | 7.5 | |
| High | CVE-2026-74909 | Red Hat: Missing Authorization | 8.1 | |
| Critical | CVE-2019-14837 | Red Hat Keycloak: Use of Hard-coded, Security-relevant Constants | 9.1 | |
| High | CVE-2026-79651 | Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching | 7.5 | |
| High | CVE-2024-1132 | Keycloak: path transversal in redirection validation | 8.1 | |
| Medium | CVE-2017-2582 | Red Hat Keycloak: Insertion of Sensitive Information Into Sent Data | 6.5 | |
| High | CVE-2026-18212 | Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state | 7.5 | |
| High | CVE-2026-15572 | Red Hat build of Keycloak: Type Confusion | 8.8 | |
| High | CVE-2017-2646 | Red Hat Keycloak: Infinite Loop | 7.5 | |
| Critical | CVE-2020-1731 | Red Hat Keycloak: Predictable from Observable State | 9.1 | |
| High | CVE-2026-17526 | Red Hat: Missing Authorization | 7.2 | |
| High | CVE-2026-7307 | Keycloak: keycloak: denial of service via specially crafted saml input | 7.5 | |
| High | CVE-2026-7507 | Red Hat build of Keycloak 26.2: Authentication Bypass by Spoofing | 7.5 | |
| High | CVE-2026-9086 | Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass | 7.3 | |
| High | CVE-2022-4137 | Keycloak: reflected xss attack | 8.1 | |
| High | CVE-2026-9800 | Keycloak vulnerable to authorization bypass via incorrect uri comparison | 8.1 | |
| High | CVE-2023-6563 | Keycloak: offline session token dos | 7.7 | |
| High | CVE-2026-1609 | Keycloak: Improper Access Control | 8.1 | |
| Medium | CVE-2024-10270 | Org.keycloak:keycloak-services: keycloak denial of service | 6.5 | |
| Medium | CVE-2026-19607 | Keycloak-services: keycloak-services: broker-originated username collision causes account lockout | 5.3 | |
| High | CVE-2020-14366 | Red Hat Keycloak: Path Traversal | 6.8 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 33sans-atrisk-mail,
- NCSC-2026-0326 [1.00] [M/H] Kwetsbaarheden verholpen in Keycloakncsc-nl,
- Credential Management: N-able Passportal Token Leak; Keycloak Password Reset Flaw; Australian Password Bookssans-newsbites-mail,
- Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Accountthehackernews,