Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how keycloak compares to other vendors in security performance

View Risk Score →

Software

keycloak keycloak
91
keycloak keycloak-services
6
keycloak keycloak admin rest api
4
keycloak keycloak admin-ui-ext
2
keycloak admin api
1
keycloak authenticator
1
keycloak clientresource (admin services)
1
keycloak fine-grained admin permissions v2 (fgap v2)
1
keycloak identity provider (idp) mapper component
1
keycloak keycloak admin api
1
keycloak keycloak admin services (keycloak: keycloak-services)
1
keycloak keycloak authorization services
1
keycloak keycloak default-groups rest endpoint and realm representation
1
keycloak keycloak organization rest api
1
keycloak keycloak policy enforcer
1
keycloak keycloak server
1
keycloak keycloak-admin-ui
1
keycloak keycloak-model-storage-service
1
keycloak keycloak-nodejs-auth-utils
1
keycloak keycloak-policy-enforcer
1
keycloak ldap user federation
1
keycloak oidc broker component
1
keycloak org.keycloak.authorization
1
keycloak org.keycloak.broker
1
keycloak organization management component
1
keycloak services
1
keycloak-services
1

Keycloak keycloak-servicesKeycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

Risk 38
Severity
6.5
First published (updated )
CVE-2026-17059

Keycloak KeycloakA missing authorization filter flaw was found in Keycloaks role-users REST API endpoint. When an aut…

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2506746

Keycloak Keycloak Admin REST APIKeycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

Risk 39
Severity
5.5
First published (updated )
CVE-2026-17048

Keycloak Keycloak Admin REST APIA sensitive information disclosure flaw was found in the Keycloak Admin REST API. The vulnerability …

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2506743

Keycloak Keycloak Admin REST APIKeycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2

Risk 22
Severity
4.3
First published (updated )
CVE-2026-16108
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Keycloak Keycloak Admin REST APIA flaw was found in the Keycloak Admin REST API when Fine-Grained Admin Permissions (FGAP) v2 is ena…

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2501740

Keycloak KeycloakKeycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

Risk 30
Severity
4.9
First published (updated )
CVE-2026-16106

Keycloak KeycloakAn incorrect authorization flaw was found in the Keycloak admin REST API endpoints responsible for r…

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2501739

Keycloak keycloak-servicesKeycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

Risk 22
Severity
4.3
First published (updated )
CVE-2026-16104

Keycloak KeycloakAn Information Exposure vulnerability was found in the GET /admin/realms/{realm}/authentication/conf…

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2501737
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Keycloak KeycloakKeycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption

Risk 22
Severity
4.3
First published (updated )
CVE-2026-16103

Keycloak keycloak-servicesKeycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Risk 34
Severity
5.4
First published (updated )
CVE-2026-16093

Keycloak keycloak-servicesA flaw was found in the Secure Client Registration executor within the keycloak-services component. …

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2501729

Keycloak organization management componentKeycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

Risk 30
Severity
4.9
First published (updated )
CVE-2026-16072

Keycloak keycloak-servicesKeycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

Risk 39
Severity
5.5
First published (updated )
CVE-2026-15943
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Keycloak KeycloakA vulnerability was identified in Keycloak's admin API where the secret masking boundary is bypassed…

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2501270

Keycloak OIDC broker componentA flaw was found in the OIDC broker component of Keycloak, which manages authentication through exte…

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2497118

Keycloak Keycloak Admin Services (keycloak: keycloak-services)Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter

Risk 22
Severity
4.3
First published (updated )
CVE-2026-14615

Keycloak KeycloakAn authorization bypass vulnerability exists in the GroupResource.getSubGroups() function of org.key…

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2496891

Keycloak ClientResource (admin services)Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource

Risk 34
Severity
5.4
First published (updated )
CVE-2026-14614
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Keycloak KeycloakA write-path authorization bypass vulnerability exists in the ClientResource.addDefaultClientScope()…

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2496889

Keycloak KeycloakKeycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

Risk 22
Severity
4.3
First published (updated )
CVE-2026-14613

Keycloak Fine-Grained Admin Permissions v2 (FGAP v2)A flaw was found in Keycloak's Fine-Grained Admin Permissions v2 (FGAP v2) implementation. When FGAP…

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2496878

Keycloak keycloak-admin-uiKeycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions

Risk 22
Severity
4.3
First published (updated )
CVE-2026-14209

Keycloak Identity Provider (IdP) mapper componentKeycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper

Risk 49
Severity
6.5
First published (updated )
CVE-2026-12388
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Keycloak Keycloak admin-ui-extKeycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak

Risk 30
Severity
4.9
First published (updated )
CVE-2026-11986

Keycloak Keycloak admin-ui-extAn authorization bypass vulnerability exists in the Keycloak admin-ui-ext bulk role-mapping-delete e…

Risk 19
Severity
4
First published (updated )
REDHAT-BUG-2487906

Keycloak KeycloakOrg.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion

Risk 60
Severity
8.1
First published (updated )
CVE-2026-11800

Keycloak KeycloakA JWT algorithm confusion vulnerability was found in Keycloak's JWT Authorization Grant flow . A fla…

Risk 33
Severity
7
First published (updated )
REDHAT-BUG-2487006

Keycloak KeycloakKeycloak: keycloak: denial of service via malformed ldap password policy response

Risk 22
Severity
4.9
EPSS
0.48%
First published (updated )
CVE-2026-9801
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203