keycloak has 6 CVEs on record. 1 was published in the last 90 days. The busiest recent month was March 2026 with 3. The median CVSS is 7.1 (high). None have a confirmed exploitation report. Most affected products: org.keycloak:keycloak-services (4), keycloak-services (1), org.keycloak:keycloak-saml-adapter-core (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 7.1
- Publish → KEV
- —
- Last 90 days
- 1 prev 1
Weakness classes
Products
- org.keycloak:keycloak-services 4
- keycloak-services 1
- org.keycloak:keycloak-saml-adapter-core 1
Worst active — by depth score
GHSA-wmxr-6j5f-838pHigh· 7.7Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions42CVE-2026-90997High· 7.4A flaw was found in Keycloak41CVE-2026-9795High· 7.3Keycloak has privilege escalation via improper scope mapping enforcement40CVE-2026-37980Medium· 6.9Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page38CVE-2026-4628Medium· 4.3Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false24
keycloak vulnerabilities
CVEs affecting keycloak, newest first. Open any entry for full detail, references, and exploit status.
6 CVEsRSS
CVE-2026-90997High· 7.4A flaw was found in Keycloak
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vuln…
CVE-2026-9795High· 7.3Keycloak has privilege escalation via improper scope mapping enforcement
Keycloak has privilege escalation via improper scope mapping enforcement
CVE-2026-37980Medium· 6.9Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
CVE-2026-4633Low· 3.7Keycloak's identity-first login flow exposes user information
Keycloak's identity-first login flow exposes user information
CVE-2026-4628Medium· 4.3Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
GHSA-wmxr-6j5f-838pHigh· 7.7Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions