CVE-2026-105306Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration Exploitation status Not known exploited Fix Not confirmed Published 10/05/2026 Severity Medium CVE-2026-105302Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access tokens Exploitation status Not known exploited Fix Not confirmed Published 10/05/2026 Severity Medium CVE-2026-105301Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker-controlled crl-dp/ocsp urls Exploitation status Not known exploited Fix Not confirmed Published 10/05/2026 Severity Medium CVE-2026-103884Keycloak-services: keycloak-services: path traversal in x.509 crl distribution point allows arbitrary local file read Exploitation status Not known exploited Fix Not confirmed Published 10/01/2026 Severity Medium CVE-2026-101333Keycloak-services: keycloak-services: unbounded metric series creation via idp tag on broker login endpoint Exploitation status Not known exploited Fix Not confirmed Published 09/28/2026 Severity Low CVE-2026-96448Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation Exploitation status Not known exploited Fix Not confirmed Published 09/25/2026 Severity Medium CVE-2026-97846Keycloak-services: keycloak-services: standard token exchange v2 bypasses mtls holder-of-key binding Exploitation status Not known exploited Fix Not confirmed Published 09/25/2026 Severity Medium CVE-2026-97311Keycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization Exploitation status Not known exploited Fix Not confirmed Published 09/24/2026 Severity Medium CVE-2026-97177Keycloak-services: keycloak-services: generic user update bypasses denied reset-password permission Exploitation status Not known exploited Fix Not confirmed Published 09/24/2026 Severity Medium CVE-2026-97176Keycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator Exploitation status Not known exploited Fix Not confirmed Published 09/24/2026 Severity Medium CVE-2026-96445Keycloak-services: keycloak-services: conditional otp skip-header policy evaluated against untrusted proxy headers Exploitation status Not known exploited Fix Not confirmed Published 09/23/2026 Severity Medium CVE-2026-96446Keycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path Exploitation status Not known exploited Fix Not confirmed Published 09/23/2026 Severity Medium CVE-2026-95503Keycloak-services: keycloak-services: potential kdc spoofing bypass when kerberos password authentication is enabled Exploitation status Not known exploited Fix Not confirmed Published 09/22/2026 Severity Medium CVE-2026-94218Keycloak-services: keycloak-services: 2fa setup enforcement bypass via authentication session restart endpoint Exploitation status Not known exploited Fix Not confirmed Published 09/21/2026 Severity Low CVE-2026-94217Keycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision Exploitation status Not known exploited Fix Not confirmed Published 09/21/2026 Severity Low CVE-2026-94215Keycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check Exploitation status Not known exploited Fix Not confirmed Published 09/21/2026 Severity Medium CVE-2026-94213Keycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity Exploitation status Not known exploited Fix Not confirmed Published 09/21/2026 Severity Medium CVE-2026-94001Keycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission Exploitation status Not known exploited Fix Not confirmed Published 09/19/2026 Severity Medium CVE-2026-94000Keycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership Exploitation status Not known exploited Fix Not confirmed Published 09/19/2026 Severity Medium CVE-2026-93999Keycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients Exploitation status Not known exploited Fix Not confirmed Published 09/19/2026 Severity Medium CVE-2026-93562Io.netty/netty-codec-http: netty: incomplete validation of malformed transfer-encoding allows http request smuggling Exploitation status Public exploit Fix Not confirmed Published 09/18/2026 Severity Medium CVE-2026-93574Io.netty/netty-codec-http: netty: http request smuggling via post-digit whitespace in chunk-size parsing Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity Medium CVE-2026-93432Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity Medium CVE-2026-93579Io.netty/netty-codec-http2: netty: http/2 header field values are not validated by default (cr/lf/nul passthrough) Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity Medium CVE-2026-93573Io.netty/netty-codec-http: netty split transfer-encoding fields bypass final-chunked validation and enable request smuggling Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity Medium CVE-2026-93568Io.netty/netty-codec-http2: io.netty/netty-codec-http3: netty: http/2 and http/3 extended connect requests are downgraded as regular connect requests Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity High CVE-2026-93569Io.netty/netty-codec-http2: http/1 absolute-form host mismatch is translated to http/2 :authority, overriding the request-target authority Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity High CVE-2026-93567Io.netty/netty-codec-http2: http/1 authority-form connect is translated to malformed http/2 connect with host-controlled :authority Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity High CVE-2026-10832Org.wildfly.security/wildfly-elytron-asn1: unbounded memory allocation in wildfly elytron asn.1 derdecoder via crafted der payload Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity Medium CVE-2026-93566Io.netty/netty-codec-http: netty: http request smuggling due to control characters in the chunk-size line Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity Medium CVE-2026-93565Io.netty/netty-codec-http: netty rtspdecoder method-token smuggling via trailing control byte Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity High CVE-2026-93564Io.netty/netty-codec-haproxy: netty: haproxy proxy-v2 nested-tlv grandchild bytebuf reference-count leak (incomplete fix of pr #16881) Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity High CVE-2026-93558Io.netty/netty-codec-http: netty: unbounded per-connection queue growth in websocketserverextensionhandler leads to denial of service Exploitation status Public exploit Fix Not confirmed Published 09/18/2026 Severity High CVE-2026-93492Io.netty/netty-codec-http2: netty: http/2 hpackencoder dos with large table size Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity Medium CVE-2026-93491Io.netty/netty-codec-http: netty: denial of service via unbounded httpservercodec http/1.1 pipeline queue Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity High CVE-2026-93488Io.netty/netty-codec-http: netty: denial of service via unbounded concurrent spdy streams Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity High CVE-2026-87743Quarkus-vertx-http: authorization bypass via path normalization discrepancy in quarkus http security Exploitation status Not known exploited Fix Not confirmed Published 09/18/2026 Severity High CVE-2026-89058Resteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard config Exploitation status Public exploit Fix Published 09/18/2026 Severity High CVE-2026-89059Resteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos) Exploitation status Public exploit Fix Published 09/18/2026 Severity High CVE-2026-90997Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch Exploitation status Not known exploited Fix Published 09/17/2026 Severity High CVE-2026-79651Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching Exploitation status Not known exploited Fix Not confirmed Published 09/16/2026 Severity High CVE-2026-74909Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments Exploitation status Not known exploited Fix Not confirmed Published 09/16/2026 Severity High CVE-2026-18212Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state Exploitation status Not known exploited Fix Not confirmed Published 09/16/2026 Severity High CVE-2026-92358Keycloak-services: keycloak-services: residual cross-browser account-link proof allows silent re-linking Exploitation status Not known exploited Fix Not confirmed Published 09/16/2026 Severity Medium CVE-2026-89298Keycloak-services: keycloak-services: confidential client secret disclosed to view-clients role via client registration get Exploitation status Not known exploited Fix Not confirmed Published 09/11/2026 Severity Medium CVE-2026-88770Keycloak-services: keycloak-services: device authorization grant issues tokens to brute-force-locked accounts Exploitation status Not known exploited Fix Not confirmed Published 09/10/2026 Severity Medium CVE-2026-19729Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters Exploitation status Not known exploited Fix Not confirmed Published 09/09/2026 Severity Medium CVE-2026-82968Keycloak-services: keycloak-services: cross-session email verification proof not bound to upstream identity for social providers Exploitation status Not known exploited Fix Not confirmed Published 09/02/2026 Severity Medium CVE-2026-17615Resteasy-core: resteasy sourceprovider remote unauthenticated file read Exploitation status Not known exploited Fix Not confirmed Published 08/31/2026 Severity High CVE-2026-79652Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired Exploitation status Not known exploited Fix Not confirmed Published 08/25/2026 Severity Medium CVE-2026-19611Wildfly-elytron: org.wildfly.security/wildfly-elytron-password-impl: wildfly-elytron: password keyspace reduction via nfkc fullwidth folding Exploitation status Not known exploited Fix Not confirmed Published 08/20/2026 Severity High CVE-2026-18963Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass Exploitation status Not known exploited Fix Not confirmed Published 08/18/2026 Severity Critical CVE-2026-19608Keycloak-services: keycloak-services: name-only group claims let same-name groups satisfy path-specific group policies Exploitation status Not known exploited Fix Not confirmed Published 08/18/2026 Severity Medium CVE-2026-18967Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow Exploitation status Not known exploited Fix Not confirmed Published 08/06/2026 Severity Medium CVE-2026-15572Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation Exploitation status Not known exploited Fix Not confirmed Published 08/05/2026 Severity High CVE-2026-16442Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction Exploitation status Not known exploited Fix Not confirmed Published 08/05/2026 Severity High CVE-2026-16100Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text Exploitation status Not known exploited Fix Not confirmed Published 08/05/2026 Severity Medium CVE-2026-16071Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary Exploitation status Not known exploited Fix Not confirmed Published 08/05/2026 Severity Medium CVE-2026-16102Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers Exploitation status Not known exploited Fix Not confirmed Published 08/05/2026 Severity High CVE-2026-15573Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher Exploitation status Not known exploited Fix Not confirmed Published 08/05/2026 Severity High CVE-2026-16443Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation Exploitation status Not known exploited Fix Not confirmed Published 08/05/2026 Severity High CVE-2026-18569Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens Exploitation status Not known exploited Fix Not confirmed Published 08/04/2026 Severity Low CVE-2026-18573Keycloak-services: keycloak-services: client access-type policy condition bypass during client update Exploitation status Not known exploited Fix Not confirmed Published 08/02/2026 Severity Medium CVE-2026-18572Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes Exploitation status Not known exploited Fix Not confirmed Published 08/02/2026 Severity Medium CVE-2026-18571Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation Exploitation status Not known exploited Fix Not confirmed Published 08/02/2026 Severity Medium CVE-2026-18570Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed Exploitation status Not known exploited Fix Not confirmed Published 08/02/2026 Severity Medium CVE-2026-18209Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check Exploitation status Not known exploited Fix Not confirmed Published 07/31/2026 Severity Low CVE-2026-18206Keycloak-services: keycloak-services: client policy source-host wildcard domain matching bypass Exploitation status Not known exploited Fix Not confirmed Published 07/31/2026 Severity Low CVE-2026-18214Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction Exploitation status Not known exploited Fix Not confirmed Published 07/31/2026 Severity Medium CVE-2026-18203Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes Exploitation status Not known exploited Fix Not confirmed Published 07/31/2026 Severity Medium CVE-2026-18211Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains Exploitation status Not known exploited Fix Not confirmed Published 07/31/2026 Severity Medium CVE-2026-18208Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim Exploitation status Not known exploited Fix Not confirmed Published 07/31/2026 Severity Medium CVE-2026-16105Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints Exploitation status Not known exploited Fix Not confirmed Published 07/31/2026 Severity Medium CVE-2026-18215Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant Exploitation status Not known exploited Fix Not confirmed Published 07/31/2026 Severity Medium CVE-2026-18217Keycloak-services: keycloak-services: saml http-redirect binding response preserves query string leading to parameter pollution Exploitation status Not known exploited Fix Not confirmed Published 07/31/2026 Severity Low CVE-2026-18218Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero Exploitation status Not known exploited Fix Not confirmed Published 07/31/2026 Severity Medium CVE-2026-18201Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations Exploitation status Not known exploited Fix Not confirmed Published 07/29/2026 Severity Medium CVE-2026-18207Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching Exploitation status Not known exploited Fix Not confirmed Published 07/29/2026 Severity Medium CVE-2026-17059Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter Exploitation status Not known exploited Fix Not confirmed Published 07/24/2026 Severity Medium CVE-2026-17048Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api Exploitation status Not known exploited Fix Not confirmed Published 07/24/2026 Severity Medium CVE-2026-16104Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins Exploitation status Not known exploited Fix Not confirmed Published 07/17/2026 Severity Medium CVE-2026-16103Keycloak-services: keycloak-services: incomplete fix for ciba brute-force lockout bypass at token redemption Exploitation status Not known exploited Fix Not confirmed Published 07/17/2026 Severity Medium CVE-2026-16106Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles Exploitation status Not known exploited Fix Not confirmed Published 07/17/2026 Severity Medium CVE-2026-16108Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2 Exploitation status Not known exploited Fix Not confirmed Published 07/17/2026 Severity Medium CVE-2026-16093Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers Exploitation status Not known exploited Fix Not confirmed Published 07/17/2026 Severity Medium CVE-2026-16089Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session Exploitation status Not known exploited Fix Not confirmed Published 07/17/2026 Severity Medium CVE-2026-16072Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation Exploitation status Not known exploited Fix Not confirmed Published 07/17/2026 Severity Medium CVE-2026-15943Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change Exploitation status Not known exploited Fix Not confirmed Published 07/17/2026 Severity Medium CVE-2026-15945Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 Exploitation status Not known exploited Fix Not confirmed Published 07/16/2026 Severity Medium CVE-2026-14781Keycloak-services: keycloak-services: oidc email_verified claim incorrectly applied to userinfo email Exploitation status Not known exploited Fix Not confirmed Published 07/05/2026 Severity Medium CVE-2026-14615Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter Exploitation status Not known exploited Fix Not confirmed Published 07/03/2026 Severity Medium CVE-2026-14614Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource Exploitation status Not known exploited Fix Not confirmed Published 07/03/2026 Severity Medium CVE-2026-14613Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission Exploitation status Not known exploited Fix Not confirmed Published 07/03/2026 Severity Medium CVE-2026-12388Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper Exploitation status Not known exploited Fix Not confirmed Published 06/30/2026 Severity Medium CVE-2026-4629Keycloak: keycloak: privilege escalation through hardcoded role mapper injection Exploitation status Not known exploited Fix Not confirmed Published 06/30/2026 Severity Medium CVE-2026-14209Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions Exploitation status Not known exploited Fix Not confirmed Published 06/30/2026 Severity Medium CVE-2026-11800Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion Exploitation status Not known exploited Fix Not confirmed Published 06/25/2026 Severity High CVE-2026-9083Keycloak: keycloak: information disclosure through arbitrary filesystem path probing Exploitation status Not known exploited Fix Not confirmed Published 06/25/2026 Severity Medium CVE-2026-9799Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass Exploitation status Not known exploited Fix Not confirmed Published 06/25/2026 Severity Medium CVE-2026-9705Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token Exploitation status Not known exploited Fix Not confirmed Published 06/25/2026 Severity Medium 
