org.keycloak:keycloak-services vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-1035Loworg.keycloak:keycloak-services: Keycloak does not validate and update refresh token usage atomically CVE-2025-14082Loworg.keycloak:keycloak-services: Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions CVE-2025-12390Mediumorg.keycloak:keycloak-services: Keycloak vulnerable to session takeovers due to reuse of session identifiers CVE-2025-12110Mediumorg.keycloak:keycloak-services: Keycloak does not invalidate offline sessions when the offline_access scope is removed CVE-2025-11429Mediumorg.keycloak:keycloak-services: Keycloak does not invalidate sessions when "Remember Me" is disabled CVE-2025-8419Mediumorg.keycloak:keycloak-services: Keycloak SMTP Inject Vulnerability CVE-2025-7784Mediumorg.keycloak:keycloak-services: Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)CVE-2025-7365Mediumorg.keycloak:keycloak-services: Keycloak phishing attack via email verification step in first login flow CVE-2025-3910Mediumorg.keycloak:keycloak-services: Keycloak vulnerable to two factor authentication bypass CVE-2025-3501Highorg.keycloak:keycloak-services: Keycloak hostname verification CVE-2025-2559Mediumorg.keycloak:keycloak-services: Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache CVE-2025-1391Mediumorg.keycloak:keycloak-services: Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims CVE-2024-10270Highorg.keycloak:keycloak-services: org.keycloak:keycloak-services has Inefficient Regular Expression Complexity CVE-2024-7341Highorg.keycloak:keycloak-services: Keycloak has session fixation in Elytron SAML adapters CVE-2024-8883Mediumorg.keycloak:keycloak-services: Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect CVE-2024-4629Mediumorg.keycloak:keycloak-services: Keycloak Services has a potential bypass of brute force protection CVE-2024-1722Loworg.keycloak:keycloak-services: Keycloak Denial of Service via account lockout CVE-2021-3754Loworg.keycloak:keycloak-services: Keycloak's improper input validation allows using email as username CVE-2024-3656Highorg.keycloak:keycloak-services: Keycloak's admin API allows low privilege users to use administrative functions CVE-2024-4540Highorg.keycloak:keycloak-services: Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)CVE-2023-0657Loworg.keycloak:keycloak-services: Keycloak vulnerable to impersonation via logout token exchange CVE-2023-6787Mediumorg.keycloak:keycloak-services: Keycloak vulnerable to session hijacking via re-authentication CVE-2024-1132Highorg.keycloak:keycloak-services: Keycloak path traversal vulnerability in redirection validation CVE-2024-1249Highorg.keycloak:keycloak-services: Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS CVE-2023-6484Mediumorg.keycloak:keycloak-services: Keycloak vulnerable to log Injection during WebAuthn authentication or registration

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo