org.keycloak:keycloak-services vulnerabilities

CVEs whose affected-version data names the org.keycloak:keycloak-services package (maven). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

org.keycloak:keycloak-services vulnerabilities

Keycloak has authentication bypass via jwt algorithm confusion

Keycloak allows unauthorized access to resources via uma permission ticket bypass

Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Keycloak: Attacker can re-enable and take over disabled clients via registration access token

Keycloak has privilege escalation via improper scope mapping enforcement

Duplicate Advisory: Authentication bypass via jwt algorithm confusion

Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing

Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass

Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token

Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison

Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass

Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page

Keycloak's identity-first login flow exposes user information

Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions