Red Hat Keycloak vulnerabilities

98 CVEs affecting Red Hat Keycloak, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-3047, published 2026-03-05.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2023-48795, published 2023-12-18. Medium severity, CVSS 5.9. EPSS: 93.5% chance of exploitation in the next 30 days. The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from…
CVE-2020-10770, published 2020-12-15. Medium severity, CVSS 5.3. EPSS: 69.7% chance of exploitation in the next 30 days. A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this…
CVE-2021-20323, published 2022-03-25. Medium severity, CVSS 6.1. EPSS: 37.2% chance of exploitation in the next 30 days. A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
CVE-2020-27838, published 2021-03-08. Medium severity, CVSS 6.5. EPSS: 17.9% chance of exploitation in the next 30 days. A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be…
CVE-2022-3782, published 2023-01-13. Critical severity, CVSS 9.1. EPSS: 5.8% chance of exploitation in the next 30 days. keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious…
CVE-2022-0225, published 2022-08-26. Medium severity, CVSS 5.4. EPSS: 3.1% chance of exploitation in the next 30 days. A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site…
CVE-2016-8627, published 2018-05-11. Medium severity, CVSS 6.5. EPSS: 2.6% chance of exploitation in the next 30 days. admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to…
CVE-2020-1714, published 2020-05-13. High severity, CVSS 8.8. EPSS: 2.6% chance of exploitation in the next 30 days. A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java…
CVE-2017-2582, published 2018-07-26. Medium severity, CVSS 6.5. EPSS: 2.4% chance of exploitation in the next 30 days. It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an…
CVE-2021-3754, published 2022-08-26. Medium severity, CVSS 5.3. EPSS: 2.1% chance of exploitation in the next 30 days. A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user. This may cause trouble in getting password recovery email in…

Latest

CVE-2026-3047, published 2026-03-05. High severity, CVSS 8.8. EPSS: 0.9% chance of exploitation in the next 30 days. A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can…
CVE-2025-12150, published 2026-02-27. Low severity, CVSS 3.1. EPSS: 0.2% chance of exploitation in the next 30 days. A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via…
CVE-2026-0871, published 2026-02-27. Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes.…
CVE-2025-8419, published 2025-08-06. Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days. A vulnerability was found in Keycloak-services. Special characters used during e-mail registration may perform SMTP Injection and unexpectedly send short unwanted e-mails. The email is limited to 64…
CVE-2025-7365, published 2025-07-10. High severity, CVSS 7.1. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider (IdP) login, the attacker will subsequently be…
CVE-2025-5416, published 2025-06-20. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can…
CVE-2023-6841, published 2024-09-10. High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days. A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when…
CVE-2024-7341, published 2024-09-09. High severity, CVSS 7.1. EPSS: 0.8% chance of exploitation in the next 30 days. A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin…
CVE-2024-7260, published 2024-09-09. Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days. An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage.…
CVE-2024-4629, published 2024-09-03. Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days. A vulnerability was found in Keycloak. This flaw allows attackers to bypass brute force protection by exploiting the timing of login attempts. By initiating multiple login requests simultaneously,…