Keycloak vulnerabilities and fixes

CVEs that mention Keycloak, ranked by priority. 8 tracked.

Keycloak has 8 tracked vulnerabilities, 2 critical. A fixed release or vendor patch exists for 6. Most recent: 2026-08-24. Highest priority: CVE-2026-18963 (score 68/100).

• CVE-2026-18963 CRITICAL 9.1 A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine fo
• CVE-2026-77995 CRITICAL 10.0 Joomla Extension - miniorange.com - Arbitrary account takeover in miniOrange OAuth Client < 3.2.0, OAuth Singl
• CVE-2026-4629 MEDIUM 6.5 MITIGATE A flaw was found in Keycloak
• CVE-2026-4633 LOW 3.7 MITIGATE A flaw was found in Keycloak
• CVE-2026-37980 MEDIUM 6.9 MITIGATE A flaw was found in Keycloak, specifically in the organization selection login page
• CVE-2026-68971 MEDIUM 6.5 UPGRADE Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom re
• CVE-2026-0976 LOW 3.7 A flaw was found in Keycloak
• CVE-2026-4628 MEDIUM 4.3 MITIGATE A flaw was found in Keycloak

FAQ

How do I fix Keycloak vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Keycloak being exploited right now?

None of the tracked Keycloak CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Keycloak CVE should I patch first?

CVE-2026-18963 currently ranks highest (68/100): A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine fo.

← Back to latest CVEs