Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 33

Export CSV
CVE-2026-16105

Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid and 5 more
CVE-2026-16102

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confidential secrets, and potentially gain full administrative control over the realm.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid and 7 more
CVE-2026-16071

Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local storage.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid 8 and 5 more
CVE-2026-14613

Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

A vulnerability was discovered in Keycloak's administrative interface that allows certain administrators to see information about groups they shouldn't have access to. When the new Fine-Grained Admin Permissions (FGAP v2) are turned on, an administrator who is allowed to see a specific "role" can also see a list of all groups assigned to that role. The system fails to check if the administrator has permission to see those specific groups. This could allow a restricted administrator to discover "hidden" groups and see their details, such as internal names and custom settings, which might contain sensitive deployment information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid and 5 more
CVE-2026-15571

Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client

A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution. The mechanism used to protect the account-linking process from unauthorized requests relies on a hash that can be predicted by a malicious OIDC client. By tricking a user into authenticating, an attacker-controlled client can forge a valid linking URL to connect the victim's account to an attacker's external identity. This results in a full account takeover, allowing the attacker to log in as the victim.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid 8 and 5 more
CVE-2026-14614

Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource

A flaw was found in the ClientResource component of Keycloak's admin services when Fine-Grained Admin Permissions (FGAP) v2 is enabled. This issue allows a delegated administrator, who should only have limited control over specific clients, to attach or remove hidden client scopes that they are not authorized to see or manage. As a result, an attacker could inject unauthorized data or permissions into the security tokens issued to end-users, potentially tricking other applications into granting higher levels of access than intended.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid and 5 more
CVE-2026-16100

Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid 8 and 5 more
CVE-2026-16442

Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid 8 and 5 more
CVE-2026-14781

Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email

A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but retrieves the email_verified status exclusively from the id_token. The root cause is a lack of validation ensuring that the email_verified claim in the id_token actually refers to the email address returned by the userinfo endpoint. If these two sources return different email addresses, the id_token's email_verified=true claim is blindly applied to the userinfo email. Exploitation Conditions: The OIDC identity provider must have trustEmail set to true (non-default). The userinfo endpoint must be enabled (default). The attacker must control or have compromised the upstream OIDC provider. Concrete Impact: Mark arbitrary email addresses as verified in the Keycloak database. Bypass email-based security controls or verification workflows. Potential account takeover if the application relies solely on the email_verified flag from the IdP to link accounts.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Build Keycloak Build Of Keycloak Data Grid and 5 more
CVE-2017-12159

keycloak: CSRF token fixation

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

CVSS 3.0 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Enterprise Linux Server Jboss Single Sign On and 2 more
CVE-2017-12158

keycloak: reflected XSS using HOST header

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

CVSS 3.0 · 5.4 Medium EPSS 1.0% KEV · Not listed
Vendors
Keycloak Redhat
Products
Keycloak Enterprise Linux Server Jboss Single Sign On and 2 more
CVE-2017-2585

keycloak: timing attack in JWS signature verification

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

CVSS 3.0 · 5.9 Medium EPSS 2.0% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Server Jboss Single Sign On Keycloak and 2 more
CVE-2016-8629

keycloak: user deletion via incorrect permissions check

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.

CVSS 3.0 · 6.5 Medium EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Enterprise Linux Server Jboss Single Sign On Keycloak and 2 more