# org.keycloak:keycloak-services (Maven) vulnerabilities Source: https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 122 vulnerabilities in org.keycloak:keycloak-services (Maven): 0 in the last 7 days and 1 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-18963, was published on 18 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 122 (1 critical, 0 exploited in the wild) ## About org.keycloak:keycloak-services (Maven) Keycloak server component providing core authentication and authorization service functionality. ## Latest org.keycloak:keycloak-services (Maven) vulnerabilities - [CVE-2026-18963: Keycloak unauthenticated account takeover via reset-credentials bypass](https://junglewise.ai/threats/cve-2026-18963-siemens-industrial-edge-management-authentication-bypass-in) (critical, CVSS 9.1, published 18 Aug 2026) - [Duplicate Advisory: Authentication bypass via jwt algorithm confusion](https://junglewise.ai/threats/duplicate-advisory-authentication-bypass-via-jwt-algorithm-confusion-40489dee) (high, CVSS 8.1, published 26 Jun 2026) - [CVE-2026-11800: Keycloak JWT algorithm confusion in JWT Authorization Grant flow](https://junglewise.ai/threats/cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow) (high, CVSS 8.1, published 25 Jun 2026) - [Duplicate Advisory: Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass](https://junglewise.ai/threats/duplicate-advisory-keycloak-vulnerable-to-cross-site-scripting-xss-via-1687acae) (high, CVSS 7.3, published 25 Jun 2026) - [Duplicate Advisory: Keycloak vulnerable to information disclosure through arbitrary filesystem path probing](https://junglewise.ai/threats/duplicate-advisory-keycloak-vulnerable-to-information-disclosure-5f6cd6b5) (medium, CVSS 4.9, published 25 Jun 2026) - [Duplicate Advisory: Keycloak allows unauthorized access to resources via uma permission ticket bypass](https://junglewise.ai/threats/duplicate-advisory-keycloak-allows-unauthorized-access-to-resources-via-1f5f5b83) (medium, CVSS 4.6, published 25 Jun 2026) - [Duplicate Advisory: Keycloak: Attacker can re-enable and take over disabled clients via registration access token](https://junglewise.ai/threats/duplicate-advisory-keycloak-attacker-can-re-enable-and-take-over-a29e27bd) (medium, CVSS 6.5, published 25 Jun 2026) - [Duplicate Advisory: Keycloak vulnerable to authorization bypass via incorrect uri comparison](https://junglewise.ai/threats/duplicate-advisory-keycloak-vulnerable-to-authorization-bypass-via-009d6a49) (high, CVSS 8.1, published 25 Jun 2026) - [CVE-2026-9800: Keycloak Policy Enforcer authorization bypass via incorrect URI comparison](https://junglewise.ai/threats/cve-2026-9800-keycloak-policy-enforcer-authorization-bypass-via-incorrect-uri) (high, CVSS 8.1, published 25 Jun 2026) - [CVE-2026-9799: Red Hat Keycloak authorization bypass in UMA permission tickets](https://junglewise.ai/threats/cve-2026-9799-red-hat-keycloak-authorization-bypass-in-uma-permission-tickets) (medium, CVSS 4.6, published 25 Jun 2026) - [CVE-2026-9705: Keycloak security bypass in client registration service](https://junglewise.ai/threats/cve-2026-9705-keycloak-security-bypass-in-client-registration-service) (medium, CVSS 6.5, published 25 Jun 2026) - [CVE-2026-9086: Keycloak XSS via case-insensitive URI validation bypass](https://junglewise.ai/threats/cve-2026-9086-keycloak-xss-via-case-insensitive-uri-validation-bypass) (high, CVSS 7.3, published 25 Jun 2026) - [CVE-2026-9083: Keycloak path traversal in key provider component](https://junglewise.ai/threats/cve-2026-9083-keycloak-path-traversal-in-key-provider-component) (medium, CVSS 4.9, published 25 Jun 2026) - [CVE-2026-9088: Keycloak information disclosure via user profile permission bypass in group members endpoint](https://junglewise.ai/threats/cve-2026-9088-keycloak-information-disclosure-via-user-profile-permission-bypass) (low, CVSS 3.1, published 5 Jun 2026) - [Keycloak privilege escalation in Fine-Grained Admin Permissions scope mapping](https://junglewise.ai/threats/keycloak-privilege-escalation-in-fine-grained-admin-permissions-scope-ac845052) (high, CVSS 7.3, published 28 May 2026) - [CVE-2026-9803: Red Hat Keycloak denial of service in ClientRegistrationAuth](https://junglewise.ai/threats/cve-2026-9803-red-hat-keycloak-denial-of-service-in-clientregistrationauth) (medium, CVSS 5.3, published 28 May 2026) - [CVE-2026-9802: Keycloak refresh token replay via session revocation bypass](https://junglewise.ai/threats/cve-2026-9802-keycloak-refresh-token-replay-via-session-revocation-bypass) (medium, CVSS 6.8, published 28 May 2026) - [CVE-2026-9798: Keycloak brute-force protection bypass in CIBA flow](https://junglewise.ai/threats/cve-2026-9798-keycloak-brute-force-protection-bypass-in-ciba-flow) (medium, CVSS 4.3, published 28 May 2026) - [CVE-2026-9795: Keycloak privilege escalation in Fine-Grained Admin Permissions](https://junglewise.ai/threats/cve-2026-9795-keycloak-privilege-escalation-in-fine-grained-admin-permissions) (high, CVSS 7.3, published 28 May 2026) - [CVE-2026-9794: Keycloak information disclosure in SAML ECP endpoint](https://junglewise.ai/threats/cve-2026-9794-keycloak-information-disclosure-in-saml-ecp-endpoint) (medium, CVSS 5.3, published 28 May 2026) - [CVE-2026-9793: Keycloak signature policy bypass in JWE-encrypted request objects](https://junglewise.ai/threats/cve-2026-9793-keycloak-signature-policy-bypass-in-jwe-encrypted-request-objects) (medium, CVSS 5.9, published 28 May 2026) - [CVE-2026-9792: Keycloak security bypass in Client Policies OIDC component](https://junglewise.ai/threats/cve-2026-9792-keycloak-security-bypass-in-client-policies-oidc-component) (medium, CVSS 6.5, published 28 May 2026) - [CVE-2026-9791: Red Hat Keycloak Incorrect Authorization in Organizations Feature](https://junglewise.ai/threats/cve-2026-9791-red-hat-keycloak-incorrect-authorization-in-organizations-feature) (medium, CVSS 4.3, published 28 May 2026) - [CVE-2026-9704: Keycloak privilege escalation via oversized subject_token JWT](https://junglewise.ai/threats/cve-2026-9704-keycloak-privilege-escalation-via-oversized-subject-token-jwt) (medium, CVSS 6.8, published 27 May 2026) - [CVE-2026-9689: Keycloak HTTP parameter pollution in OIDC redirect URI](https://junglewise.ai/threats/cve-2026-9689-keycloak-http-parameter-pollution-in-oidc-redirect-uri) (medium, CVSS 4.2, published 27 May 2026) ## Most severe org.keycloak:keycloak-services (Maven) vulnerabilities - [CVE-2026-18963: Keycloak unauthenticated account takeover via reset-credentials bypass](https://junglewise.ai/threats/cve-2026-18963-siemens-industrial-edge-management-authentication-bypass-in) (critical, CVSS 9.1, published 18 Aug 2026) - [CVE-2026-1486: Keycloak improper security check for disabled Identity Providers](https://junglewise.ai/threats/cve-2026-1486-keycloak-improper-security-check-for-disabled-identity-providers) (high, CVSS 8.8, published 9 Feb 2026) - [CVE-2026-2603: Keycloak SAML broker authentication bypass via disabled Identity Provider](https://junglewise.ai/threats/cve-2026-2603-keycloak-saml-broker-authentication-bypass-via-disabled-identity) (high, CVSS 8.1, published 18 Mar 2026) - [CVE-2026-9800: Keycloak Policy Enforcer authorization bypass via incorrect URI comparison](https://junglewise.ai/threats/cve-2026-9800-keycloak-policy-enforcer-authorization-bypass-via-incorrect-uri) (high, CVSS 8.1, published 25 Jun 2026) - [CVE-2026-7504: Red Hat Keycloak open redirect via URL validation bypass](https://junglewise.ai/threats/cve-2026-7504-red-hat-keycloak-open-redirect-via-url-validation-bypass) (high, CVSS 8.1, published 19 May 2026) - [CVE-2026-4636: Keycloak UMA policy bypass in Protection API](https://junglewise.ai/threats/cve-2026-4636-keycloak-uma-policy-bypass-in-protection-api) (high, CVSS 8.1, published 2 Apr 2026) - [CVE-2026-3009: Keycloak authentication bypass via disabled Identity Provider](https://junglewise.ai/threats/cve-2026-3009-keycloak-authentication-bypass-via-disabled-identity-provider) (high, CVSS 8.1, published 5 Mar 2026) - [CVE-2026-1529: Keycloak improper signature verification in organization invitations](https://junglewise.ai/threats/cve-2026-1529-keycloak-improper-signature-verification-in-organization) (high, CVSS 8.1, published 9 Feb 2026) - [CVE-2026-11800: Keycloak JWT algorithm confusion in JWT Authorization Grant flow](https://junglewise.ai/threats/cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow) (high, CVSS 8.1, published 25 Jun 2026) - [Duplicate Advisory: Authentication bypass via jwt algorithm confusion](https://junglewise.ai/threats/duplicate-advisory-authentication-bypass-via-jwt-algorithm-confusion-40489dee) (high, CVSS 8.1, published 26 Jun 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 1 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Maven technologies - [org.jenkins-ci.main:jenkins-core (Maven)](https://junglewise.ai/threats/technologies/org-jenkins-ci-main-jenkins-core): 259 vulnerabilities - [org.apache.tomcat:tomcat (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat): 169 vulnerabilities - [com.liferay.portal:release.portal.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-portal-bom): 159 vulnerabilities - [com.liferay.portal:release.dxp.bom (Maven)](https://junglewise.ai/threats/technologies/com-liferay-portal-release-dxp-bom): 125 vulnerabilities - [com.fasterxml.jackson.core:jackson-databind (Maven)](https://junglewise.ai/threats/technologies/com-fasterxml-jackson-core-jackson-databind): 86 vulnerabilities - [org.apache.tomcat.embed:tomcat-embed-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-embed-tomcat-embed-core): 83 vulnerabilities - [org.apache.struts:struts2-core (Maven)](https://junglewise.ai/threats/technologies/org-apache-struts-struts2-core): 60 vulnerabilities - [org.keycloak:keycloak-core (Maven)](https://junglewise.ai/threats/technologies/org-keycloak-keycloak-core): 57 vulnerabilities - [org.xwiki.platform:xwiki-platform-oldcore (Maven)](https://junglewise.ai/threats/technologies/org-xwiki-platform-xwiki-platform-oldcore): 46 vulnerabilities - [org.apache.tomcat:tomcat-catalina (Maven)](https://junglewise.ai/threats/technologies/org-apache-tomcat-tomcat-catalina): 44 vulnerabilities - [org.elasticsearch:elasticsearch (Maven)](https://junglewise.ai/threats/technologies/org-elasticsearch-elasticsearch): 41 vulnerabilities - [io.undertow:undertow-core (Maven)](https://junglewise.ai/threats/technologies/io-undertow-undertow-core): 40 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "org.keycloak:keycloak-services (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-keycloak-keycloak-services, 9 November 2026.