Keycloak has 15 CVEs on record. Cadence is steady at roughly 5 per quarter. The busiest recent month was June 2026 with 5. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-79 (3). Most affected products: org.keycloak:keycloak-services (13), keycloak-services (1), org.keycloak:keycloak-saml-adapter-core (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 5 prev 6
Weakness classes
Products
- org.keycloak:keycloak-services 13
- keycloak-services 1
- org.keycloak:keycloak-saml-adapter-core 1
Worst active — by depth score
CVE-2026-9086High· 7.3Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass52GHSA-79qw-g39g-mfxcHigh· 8.1Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison45GHSA-wmxr-6j5f-838pHigh· 7.7Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions42CVE-2026-90997High· 7.4A flaw was found in Keycloak41CVE-2026-9795High· 7.3Keycloak has privilege escalation via improper scope mapping enforcement40
Keycloak vulnerabilities
CVEs affecting Keycloak, newest first. Open any entry for full detail, references, and exploit status.
15 CVEsRSS
CVE-2026-9799Medium· 4.6Keycloak allows unauthorized access to resources via uma permission ticket bypass
Keycloak allows unauthorized access to resources via uma permission ticket bypass
CVE-2026-9083Medium· 4.9Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
CVE-2026-9086High· 7.3PoCKeycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
CVE-2026-9705Medium· 6.5Keycloak: Attacker can re-enable and take over disabled clients via registration access token
Keycloak: Attacker can re-enable and take over disabled clients via registration access token
CVE-2026-90997High· 7.4A flaw was found in Keycloak
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vuln…
CVE-2026-9795High· 7.3Keycloak has privilege escalation via improper scope mapping enforcement
Keycloak has privilege escalation via improper scope mapping enforcement
GHSA-7pm9-g8jh-3m74Medium· 4.9Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing
GHSA-37j9-56gh-j2r7High· 7.3Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
GHSA-q929-g23j-2rc7Medium· 6.5Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token
Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token
GHSA-79qw-g39g-mfxcHigh· 8.1Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison
Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison
GHSA-gfv4-4vr2-rr4gMedium· 4.6Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass
Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass
CVE-2026-37980Medium· 6.9Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
CVE-2026-4633Low· 3.7Keycloak's identity-first login flow exposes user information
Keycloak's identity-first login flow exposes user information
CVE-2026-4628Medium· 4.3Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
GHSA-wmxr-6j5f-838pHigh· 7.7Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions