# Keycloak vulnerabilities Source: https://junglewise.ai/threats/technologies/keycloak Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/keycloak.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 66 vulnerabilities in Keycloak: 7 in the last 7 days and 16 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112201, was published on 11 November 2026. 9 vulnerabilities in the last four weeks, up 80% on the four before (5). 1 critical against 0. ## Counts - Last 7 days: 7 - Last 30 days: 10 - Last 90 days: 16 - All time: 66 (1 critical, 0 exploited in the wild) ## About Keycloak Keycloak is an open source identity and access management solution for securing applications and services. ## Latest Keycloak vulnerabilities - [CVE-2026-112201: Keycloak login-failure storage synchronization error in MySQL/MariaDB](https://junglewise.ai/threats/cve-2026-112201-a-flaw-was-found-in-the-login-failure-storage-component-of) (medium, CVSS 4.8, published 11 Nov 2026) - [CVE-2026-125652: Keycloak PKCE bypass in login after password reset](https://junglewise.ai/threats/cve-2026-125652-a-flaw-was-found-in-the-keycloak-services-component-of-keycloak) (medium, CVSS 6.8, published 10 Nov 2026) - [CVE-2026-120984: Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management) (critical, CVSS 9.1, published 7 Nov 2026) - [CVE-2026-97848: Keycloak token sanitization bypass in protocol mapper](https://junglewise.ai/threats/cve-2026-97848-a-flaw-was-found-in-the-token-sanitization-logic-of-keycloak-an) (medium, CVSS 6.5, published 6 Nov 2026) - [CVE-2026-96547: Keycloak Dynamic Client Registration privilege escalation](https://junglewise.ai/threats/cve-2026-96547-a-flaw-was-found-in-the-dynamic-client-registration-component-of) (medium, CVSS 6.5, published 6 Nov 2026) - [CVE-2026-96447: Keycloak TokenManager identity rebinding in stateless token validation](https://junglewise.ai/threats/cve-2026-96447-a-flaw-was-found-in-the-tokenmanager-component-of-keycloak-an) (medium, CVSS 4.2, published 6 Nov 2026) - [CVE-2026-19688: Keycloak Admin REST API audience verification bypass](https://junglewise.ai/threats/cve-2026-19688-a-flaw-was-found-in-the-admin-rest-api-of-keycloak-an-identity) (medium, CVSS 6.8, published 6 Nov 2026) - [CVE-2026-82965: Keycloak SAML XML denial of service via unbounded parsing](https://junglewise.ai/threats/cve-2026-82965-a-flaw-was-found-in-the-saml-implementation-of-keycloak-an-open) (high, CVSS 7.5, published 5 Nov 2026) - [CVE-2026-107602: Keycloak SAML 1.1 XML parser infinite loop denial of service](https://junglewise.ai/threats/cve-2026-107602-a-flaw-was-found-in-the-saml-1-1-xml-parsing-logic-of-keycloak) (high, CVSS 7.5, published 5 Nov 2026) - [CVE-2026-103112: Keycloak authentication session handling race condition](https://junglewise.ai/threats/cve-2026-103112-a-flaw-was-found-in-the-authentication-session-handling-of-the) (high, CVSS 7.5, published 5 Nov 2026) - [CVE-2026-109082: Keycloak CIBA authorization bypass in keycloak-services](https://junglewise.ai/threats/cve-2026-109082-a-flaw-was-found-in-the-client-initiated-backchannel) (medium, CVSS 6.8, published 12 Oct 2026) - [CVE-2026-94213: Keycloak Authorization Services policy evaluation missing authorization check](https://junglewise.ai/threats/cve-2026-94213-a-flaw-was-found-in-the-authorization-services-component-of) (medium, CVSS 4.9, published 21 Sep 2026) - [CVE-2026-94001: Keycloak Admin REST API missing authorization in credential deletion](https://junglewise.ai/threats/cve-2026-94001-a-flaw-was-found-in-the-admin-rest-api-of-keycloak-an-open-source) (medium, CVSS 6.5, published 19 Sep 2026) - [CVE-2026-19607: Keycloak first-broker-login account collision flaw](https://junglewise.ai/threats/cve-2026-19607-keycloak-first-broker-login-account-collision-flaw) (medium, CVSS 5.3, published 16 Sep 2026) - [CVE-2026-17526: Keycloak privilege escalation via impersonation role](https://junglewise.ai/threats/cve-2026-17526-keycloak-privilege-escalation-via-impersonation-role) (high, CVSS 7.2, published 16 Sep 2026) - [CVE-2026-18212: Keycloak SAML Redirect Binding memory exhaustion](https://junglewise.ai/threats/cve-2026-18212-keycloak-saml-redirect-binding-memory-exhaustion) (high, CVSS 7.5, published 16 Sep 2026) - [CVE-2026-18573: Keycloak client policy bypass in confidential client creation](https://junglewise.ai/threats/cve-2026-18573-keycloak-client-policy-bypass-in-confidential-client-creation) (medium, CVSS 6.5, published 2 Aug 2026) - [CVE-2026-18217: Keycloak SAML HTTP Parameter Pollution in HTTP-Redirect binding](https://junglewise.ai/threats/cve-2026-18217-keycloak-saml-http-parameter-pollution-in-http-redirect-binding) (low, CVSS 3.4, published 31 Jul 2026) - [CVE-2026-18214: Keycloak domain restriction bypass in Google token exchange](https://junglewise.ai/threats/cve-2026-18214-keycloak-domain-restriction-bypass-in-google-token-exchange) (medium, CVSS 6.8, published 31 Jul 2026) - [CVE-2026-18208: Keycloak information disclosure in OIDC token introspection endpoint](https://junglewise.ai/threats/cve-2026-18208-keycloak-information-disclosure-in-oidc-token-introspection) (medium, CVSS 6.5, published 31 Jul 2026) - [CVE-2026-17059: Keycloak keycloak-services authorization bypass in role-users endpoint](https://junglewise.ai/threats/cve-2026-17059-keycloak-keycloak-services-authorization-bypass-in-role-users) (medium, CVSS 6.5, published 24 Jul 2026) - [CVE-2026-1609: Keycloak improper access control for disabled users in JWT authorization grant](https://junglewise.ai/threats/cve-2026-1609-keycloak-improper-access-control-for-disabled-users-in-jwt) (high, CVSS 8.1, published 16 Jul 2026) - [CVE-2026-4629: Keycloak privilege escalation via hardcoded role mapper injection](https://junglewise.ai/threats/cve-2026-4629-keycloak-privilege-escalation-via-hardcoded-role-mapper-injection) (medium, CVSS 6.5, published 30 Jun 2026) - [CVE-2026-11800: Keycloak JWT algorithm confusion in JWT Authorization Grant flow](https://junglewise.ai/threats/cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow) (high, CVSS 8.1, published 25 Jun 2026) - [CVE-2026-9705: Keycloak security bypass in client registration service](https://junglewise.ai/threats/cve-2026-9705-keycloak-security-bypass-in-client-registration-service) (medium, CVSS 6.5, published 25 Jun 2026) ## Most severe Keycloak vulnerabilities - [CVE-2026-120984: Keycloak server arbitrary code execution in client authorization](https://junglewise.ai/threats/cve-2026-120984-a-flaw-was-found-in-the-keycloak-server-s-client-management) (critical, CVSS 9.1, published 7 Nov 2026) - [CVE-2026-1486: Keycloak improper security check for disabled Identity Providers](https://junglewise.ai/threats/cve-2026-1486-keycloak-improper-security-check-for-disabled-identity-providers) (high, CVSS 8.8, published 9 Feb 2026) - [CVE-2026-2603: Keycloak SAML broker authentication bypass via disabled Identity Provider](https://junglewise.ai/threats/cve-2026-2603-keycloak-saml-broker-authentication-bypass-via-disabled-identity) (high, CVSS 8.1, published 18 Mar 2026) - [CVE-2026-7504: Red Hat Keycloak open redirect via URL validation bypass](https://junglewise.ai/threats/cve-2026-7504-red-hat-keycloak-open-redirect-via-url-validation-bypass) (high, CVSS 8.1, published 19 May 2026) - [CVE-2026-11800: Keycloak JWT algorithm confusion in JWT Authorization Grant flow](https://junglewise.ai/threats/cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow) (high, CVSS 8.1, published 25 Jun 2026) - [CVE-2026-1609: Keycloak improper access control for disabled users in JWT authorization grant](https://junglewise.ai/threats/cve-2026-1609-keycloak-improper-access-control-for-disabled-users-in-jwt) (high, CVSS 8.1, published 16 Jul 2026) - [CVE-2026-2092: Keycloak improper validation of encrypted SAML assertions](https://junglewise.ai/threats/cve-2026-2092-keycloak-improper-validation-of-encrypted-saml-assertions) (high, CVSS 7.7, published 18 Mar 2026) - [CVE-2026-7307: Keycloak denial of service in SAML endpoint](https://junglewise.ai/threats/cve-2026-7307-keycloak-denial-of-service-in-saml-endpoint) (high, CVSS 7.5, published 19 May 2026) - [CVE-2026-7507: Keycloak session fixation in login-actions endpoints](https://junglewise.ai/threats/cve-2026-7507-keycloak-session-fixation-in-login-actions-endpoints) (high, CVSS 7.5, published 19 May 2026) - [CVE-2026-18212: Keycloak SAML Redirect Binding memory exhaustion](https://junglewise.ai/threats/cve-2026-18212-keycloak-saml-redirect-binding-memory-exhaustion) (high, CVSS 7.5, published 16 Sep 2026) ## Vulnerabilities per week 9 vulnerabilities in the last four weeks, up 80% on the four before (5). 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 4 | 0 | 0 | | 21 Sep 2026 | 1 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 8 | 1 | 0 | | 9 Nov 2026 | 2 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Keycloak vulnerabilities", https://junglewise.ai/threats/technologies/keycloak, 13 November 2026.