keycloak vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20202
3. 20231
4. 20259
5. 20263

Newest CVEs

• CVE-2026-90997

  Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

  Keycloak · Keycloak

  High7.4
• CVE-2026-1609

  Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

  Keycloak · Keycloak

  High8.1
• CVE-2025-12150

  Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

  Keycloak · keycloak

  Low3.1
• CVE-2025-13467

  Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation

  Keycloak · Keycloak

  Medium5.5
• CVE-2025-11538

  Keycloak-server: debug default bind address

  Keycloak · keycloak

  Medium6.8
• CVE-2025-12390

  Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id

  Keycloak · keycloak

  Medium6.0
• CVE-2025-10939

  Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console

  Keycloak · keycloak

  Low3.7
• CVE-2025-12110

  Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed

  Keycloak · keycloak

  Medium5.4
• CVE-2025-11429

  Keycloak-server: too long and not settings compliant session

  Keycloak · keycloak

  Medium5.4
• CVE-2025-10044

  Keycloak: keycloak error_description injection on error pages

  Keycloak · keycloak

  Medium4.3