keycloak vulnerabilities and fixes

Recent CVEs affecting keycloak, with upgrade or downgrade steps. 98 tracked.

keycloak has 98 tracked vulnerabilities, 6 critical. A fixed release or vendor patch exists for 66. Most recent: 2026-03-05. Highest priority: CVE-2019-14837 (score 66/100).

• CVE-2023-6927 MEDIUM 4.6 MITIGATE DOWNGRADE A flaw was found in Keycloak
• CVE-2023-6563 HIGH 7.7 UPGRADE DOWNGRADE An unconstrained memory consumption vulnerability was discovered in Keycloak
• CVE-2023-6291 HIGH 7.1 UPGRADE DOWNGRADE A flaw was found in the redirect_uri validation logic in Keycloak
• CVE-2023-6134 MEDIUM 4.6 UPGRADE UPGRADE A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is app
• CVE-2025-8419 MEDIUM 5.3 MITIGATE A vulnerability was found in Keycloak-services
• CVE-2025-7365 HIGH 7.1 MITIGATE A flaw was found in Keycloak
• CVE-2024-7341 HIGH 7.1 UPGRADE UPGRADE A session fixation issue was discovered in the SAML adapters provided by Keycloak
• CVE-2025-12150 LOW 3.1 UPGRADE DOWNGRADE A flaw was found in Keycloak’s WebAuthn registration component
• CVE-2024-1132 HIGH 8.1 MITIGATE DOWNGRADE A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect
• CVE-2026-3047 HIGH 8.8 DOWNGRADE MITIGATE A flaw was found in org.keycloak.broker.saml
• CVE-2026-0871 MEDIUM 4.9 UPGRADE UPGRADE A flaw was found in Keycloak
• CVE-2025-5416 LOW 2.7 MITIGATE A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure
• CVE-2024-7260 MEDIUM 6.1 UPGRADE UPGRADE An open redirect vulnerability was found in Keycloak
• CVE-2024-4629 MEDIUM 6.5 UPGRADE UPGRADE A vulnerability was found in Keycloak
• CVE-2024-1722 LOW 3.7 DOWNGRADE A flaw was found in Keycloak
• CVE-2023-6841 HIGH 7.5 MITIGATE DOWNGRADE A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limit
• CVE-2023-4918 HIGH 8.8 DOWNGRADE A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile
• CVE-2023-2422 MEDIUM 5.5 MITIGATE DOWNGRADE A flaw was found in Keycloak
• CVE-2023-1664 MEDIUM 6.5 MITIGATE DOWNGRADE A flaw was found in Keycloak
• CVE-2023-0264 MEDIUM 5.0 UPGRADE UPGRADE A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests
• CVE-2023-0105 MEDIUM 6.5 MITIGATE A flaw was found in Keycloak
• CVE-2023-0091 LOW 3.8 MITIGATE A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its cli
• CVE-2022-4361 CRITICAL 10.0 UPGRADE UPGRADE Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerabili
• CVE-2022-4137 HIGH 8.1 MITIGATE DOWNGRADE A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect nu
• CVE-2022-3916 MEDIUM 6.8 UPGRADE DOWNGRADE A flaw was found in the offline_access scope in Keycloak
• CVE-2022-3782 CRITICAL 9.1 DOWNGRADE keycloak: path traversal via double URL encoding
• CVE-2022-2668 HIGH 7.2 DOWNGRADE DOWNGRADE An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapp
• CVE-2022-1466 MEDIUM 6.5 UPGRADE DOWNGRADE Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they shou
• CVE-2022-1438 MEDIUM 6.4 MITIGATE A flaw was found in Keycloak
• CVE-2022-1274 MEDIUM 5.4 UPGRADE UPGRADE A flaw was found in Keycloak in the execute-actions-email endpoint
• CVE-2022-1245 CRITICAL 9.8 UPGRADE A privilege escalation flaw was found in the token exchange feature of keycloak
• CVE-2022-0225 MEDIUM 5.4 MITIGATE DOWNGRADE A flaw was found in Keycloak
• CVE-2021-4133 HIGH 8.8 UPGRADE A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any exist
• CVE-2021-3856 MEDIUM 4.3 UPGRADE ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to
• CVE-2021-3827 MEDIUM 6.8 UPGRADE DOWNGRADE A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypas
• CVE-2021-3754 MEDIUM 5.3 MITIGATE DOWNGRADE A flaw was found in keycloak where an attacker is able to register himself with the username same as the email
• CVE-2021-3637 HIGH 7.5 UPGRADE DOWNGRADE A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions
• CVE-2021-3632 HIGH 7.5 UPGRADE UPGRADE A flaw was found in Keycloak
• CVE-2021-3513 HIGH 7.5 UPGRADE A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is
• CVE-2021-3461 HIGH 7.1 DOWNGRADE DOWNGRADE A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from e
• CVE-2021-20323 MEDIUM 6.1 UPGRADE A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
• CVE-2021-20262 MEDIUM 6.8 DOWNGRADE DOWNGRADE A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password
• CVE-2021-20222 HIGH 7.5 UPGRADE A flaw was found in keycloak
• CVE-2021-20202 HIGH 7.3 UPGRADE A flaw was found in keycloak
• CVE-2021-20195 CRITICAL 9.6 UPGRADE A flaw was found in keycloak in versions before 13.0.0
• CVE-2020-35509 MEDIUM 5.4 DOWNGRADE A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0
• CVE-2020-27838 MEDIUM 6.5 UPGRADE DOWNGRADE A flaw was found in keycloak in versions prior to 13.0.0
• CVE-2020-27826 MEDIUM 4.2 UPGRADE DOWNGRADE A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attribut
• CVE-2020-1758 MEDIUM 5.3 UPGRADE DOWNGRADE A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verificatio
• CVE-2020-1744 MEDIUM 5.6 UPGRADE A flaw was found in keycloak before version 9.0.1
• CVE-2020-1728 MEDIUM 4.8 UPGRADE UPGRADE A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the applic
• CVE-2020-1727 MEDIUM 6.4 UPGRADE A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server
• CVE-2020-1725 MEDIUM 5.4 UPGRADE A flaw was found in keycloak before version 13.0.0
• CVE-2020-1724 MEDIUM 4.3 UPGRADE MITIGATE A flaw was found in Keycloak in versions before 9.0.2
• CVE-2020-1718 HIGH 7.1 DOWNGRADE UPGRADE A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0
• CVE-2020-1717 LOW 2.7 DOWNGRADE DOWNGRADE A flaw was found in Keycloak 7.0.1
• CVE-2020-1714 HIGH 8.8 UPGRADE DOWNGRADE A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream w
• CVE-2020-1698 MEDIUM 5.0 UPGRADE A flaw was found in keycloak in versions before 9.0.0
• CVE-2020-1697 MEDIUM 6.1 UPGRADE DOWNGRADE It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in
• CVE-2020-1694 MEDIUM 4.9 UPGRADE A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verif
• CVE-2020-14389 HIGH 8.1 UPGRADE It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the
• CVE-2020-14366 MEDIUM 6.8 UPGRADE A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is
• CVE-2020-14302 MEDIUM 4.9 UPGRADE A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authenticatio
• CVE-2020-10776 MEDIUM 4.8 UPGRADE A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirec
• CVE-2020-10770 MEDIUM 5.3 UPGRADE A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified
• CVE-2020-10758 HIGH 7.5 UPGRADE DOWNGRADE A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests si
• CVE-2020-10748 MEDIUM 6.1 DOWNGRADE UPGRADE A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in
• CVE-2020-10734 LOW 3.3 MITIGATE DOWNGRADE A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection
• CVE-2020-10686 MEDIUM 4.1 DOWNGRADE A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicio
• CVE-2019-3875 MEDIUM 6.5 UPGRADE DOWNGRADE A vulnerability was found in keycloak before 6.0.2
• CVE-2019-3868 LOW 3.8 UPGRADE Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cook
• CVE-2019-14910 CRITICAL 9.8 DOWNGRADE A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS
• CVE-2019-14909 HIGH 8.3 DOWNGRADE A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bin
• CVE-2019-14837 CRITICAL 9.1 UPGRADE DOWNGRADE A flaw was found in keycloack before version 8.0.0
• CVE-2019-14832 HIGH 7.5 UPGRADE A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm
• CVE-2019-14820 MEDIUM 4.3 UPGRADE DOWNGRADE It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.A
• CVE-2019-10201 HIGH 8.1 UPGRADE DOWNGRADE It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures
• CVE-2019-10199 HIGH 8.8 UPGRADE It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requ
• CVE-2019-10170 MEDIUM 6.6 UPGRADE A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be se
• CVE-2019-10169 MEDIUM 6.6 UPGRADE A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the
• CVE-2019-10157 MEDIUM 4.7 UPGRADE UPGRADE It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token receiv
• CVE-2018-14637 MEDIUM 6.1 UPGRADE The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML
• CVE-2018-10912 MEDIUM 4.9 UPGRADE DOWNGRADE keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement
• CVE-2018-10894 MEDIUM 5.4 DOWNGRADE DOWNGRADE It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates
• CVE-2017-2646 HIGH 7.5 UPGRADE It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the
• CVE-2017-2585 MEDIUM 5.9 UPGRADE DOWNGRADE Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a me
• CVE-2017-2582 MEDIUM 6.5 UPGRADE DOWNGRADE It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces s
• CVE-2017-12161 HIGH 8.8 UPGRADE It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a
• CVE-2017-12160 HIGH 7.2 MITIGATE It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair
• CVE-2017-12159 HIGH 7.5 DOWNGRADE MITIGATE It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session
• CVE-2017-12158 MEDIUM 5.4 DOWNGRADE MITIGATE It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web res
• CVE-2016-8629 MEDIUM 6.5 UPGRADE DOWNGRADE Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user d
• CVE-2016-8627 MEDIUM 4.3 DOWNGRADE MITIGATE admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log file
• CVE-2016-8609 LOW 3.7 UPGRADE It was found that the keycloak before 2.3.0 did not implement authentication flow correctly
• CVE-2014-3709 HIGH 8.8 UPGRADE The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows
• CVE-2014-3655 MEDIUM 4.3 UPGRADE DOWNGRADE JBoss KeyCloak is vulnerable to soft token deletion via CSRF
• CVE-2014-3652 MEDIUM 6.1 DOWNGRADE JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.
• CVE-2014-3651 HIGH 7.5 UPGRADE JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption)

FAQ

How do I fix keycloak vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is keycloak being exploited right now?

None of the tracked keycloak CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which keycloak CVE should I patch first?

CVE-2019-14837 currently ranks highest (66/100): A flaw was found in keycloack before version 8.0.0.

RSS feed for keycloak · ← Back to latest CVEs