Skip to content
OpenAdvisories

Vendor

Keycloak

17 known vulnerabilities.

Products

Keycloak 15 keycloak REST API 1 keycloak-services 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Low 3.1
    CVE-2025-12150

    Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

    A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even wh…

    Red Hat Keycloak Red Hat build of Keycloak 26.4 Red Hat build of Keycloak 26.2 Maven
  • Low 3.7
    CVE-2025-10939

    Org.keycloak/keycloak-quarkus-server: unable to restrict access to the admin console

    A flaw was found in Keycloak. The Keycloak guides recommend to not expose /admin path to the outside in case the installation is using a proxy. The issue occurs at least via ha-proxy, as it can be tricked to using relative/non-normalized paths to access the /…

    Red Hat Keycloak Red Hat build of Keycloak 26.4 Keycloak Maven