Skip to content
OpenAdvisories

Vendor

Keycloak

16 known vulnerabilities.

Products

Keycloak 15 keycloak REST API 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • High 7.4
    CVE-2026-90997

    Keycloak-services: keycloak: replay protection bypass leads to unauthorized access via database driver semantics mismatch

    A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an a…

    Red Hat Keycloak Red Hat Build of Keycloak Keycloak
  • High 8.1
    CVE-2026-1609

    Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

    A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with …

    Red Hat Keycloak Red Hat JBoss Enterprise Application Platform Expansion Pack Red Hat JBoss Enterprise Application Platform 8