{"schema_version":1,"title":"Keycloak vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 57 vulnerabilities in Keycloak: 2 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-94213, was published on 21 September 2026. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/keycloak","json_url":"https://junglewise.ai/threats/vendors/keycloak.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/keycloak","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":16,"all_time":57,"critical":0,"exploited":0,"last_7_days":2,"last_30_days":5,"last_90_days":13,"last_365_days":56},"latest":[{"cve":"CVE-2026-94213","cvss":4.9,"epss":0.0039,"slug":"cve-2026-94213-a-flaw-was-found-in-the-authorization-services-component-of","title":"Keycloak Authorization Services policy evaluation missing authorization check","severity":"medium","exploited":false,"published_at":"2026-09-21T07:16:54.163+00:00","url":"https://junglewise.ai/threats/cve-2026-94213-a-flaw-was-found-in-the-authorization-services-component-of"},{"cve":"CVE-2026-94001","cvss":6.5,"epss":0.0044,"slug":"cve-2026-94001-a-flaw-was-found-in-the-admin-rest-api-of-keycloak-an-open-source","title":"Keycloak Admin REST API missing authorization in credential deletion","severity":"medium","exploited":false,"published_at":"2026-09-19T15:17:08.903+00:00","url":"https://junglewise.ai/threats/cve-2026-94001-a-flaw-was-found-in-the-admin-rest-api-of-keycloak-an-open-source"},{"cve":"CVE-2026-19607","cvss":5.3,"epss":0.0051,"slug":"cve-2026-19607-keycloak-first-broker-login-account-collision-flaw","title":"Keycloak first-broker-login account collision flaw","severity":"medium","exploited":false,"published_at":"2026-09-16T16:17:06.607+00:00","url":"https://junglewise.ai/threats/cve-2026-19607-keycloak-first-broker-login-account-collision-flaw"},{"cve":"CVE-2026-17526","cvss":7.2,"epss":0.0045,"slug":"cve-2026-17526-keycloak-privilege-escalation-via-impersonation-role","title":"Keycloak privilege escalation via impersonation role","severity":"high","exploited":false,"published_at":"2026-09-16T16:17:04.647+00:00","url":"https://junglewise.ai/threats/cve-2026-17526-keycloak-privilege-escalation-via-impersonation-role"},{"cve":"CVE-2026-18212","cvss":7.5,"epss":0.0052,"slug":"cve-2026-18212-keycloak-saml-redirect-binding-memory-exhaustion","title":"Keycloak SAML Redirect Binding memory exhaustion","severity":"high","exploited":false,"published_at":"2026-09-16T15:17:33.257+00:00","url":"https://junglewise.ai/threats/cve-2026-18212-keycloak-saml-redirect-binding-memory-exhaustion"},{"cve":"CVE-2026-18573","cvss":6.5,"epss":0.0048,"slug":"cve-2026-18573-keycloak-client-policy-bypass-in-confidential-client-creation","title":"Keycloak client policy bypass in confidential client creation","severity":"medium","exploited":false,"published_at":"2026-08-02T06:16:42.673+00:00","url":"https://junglewise.ai/threats/cve-2026-18573-keycloak-client-policy-bypass-in-confidential-client-creation"},{"cve":"CVE-2026-18217","cvss":3.4,"slug":"cve-2026-18217-keycloak-saml-http-parameter-pollution-in-http-redirect-binding","title":"Keycloak SAML HTTP Parameter Pollution in HTTP-Redirect binding","severity":"low","exploited":false,"published_at":"2026-07-31T08:16:28.037+00:00","url":"https://junglewise.ai/threats/cve-2026-18217-keycloak-saml-http-parameter-pollution-in-http-redirect-binding"},{"cve":"CVE-2026-18214","cvss":6.8,"slug":"cve-2026-18214-keycloak-domain-restriction-bypass-in-google-token-exchange","title":"Keycloak domain restriction bypass in Google token exchange","severity":"medium","exploited":false,"published_at":"2026-07-31T08:16:27.753+00:00","url":"https://junglewise.ai/threats/cve-2026-18214-keycloak-domain-restriction-bypass-in-google-token-exchange"},{"cve":"CVE-2026-18208","cvss":6.5,"slug":"cve-2026-18208-keycloak-information-disclosure-in-oidc-token-introspection","title":"Keycloak information disclosure in OIDC token introspection endpoint","severity":"medium","exploited":false,"published_at":"2026-07-31T08:16:27.323+00:00","url":"https://junglewise.ai/threats/cve-2026-18208-keycloak-information-disclosure-in-oidc-token-introspection"},{"cve":"CVE-2026-17059","cvss":6.5,"slug":"cve-2026-17059-keycloak-keycloak-services-authorization-bypass-in-role-users","title":"Keycloak keycloak-services authorization bypass in role-users endpoint","severity":"medium","exploited":false,"published_at":"2026-07-24T15:17:13.3+00:00","url":"https://junglewise.ai/threats/cve-2026-17059-keycloak-keycloak-services-authorization-bypass-in-role-users"},{"cve":"CVE-2026-1609","cvss":8.1,"slug":"cve-2026-1609-keycloak-improper-access-control-for-disabled-users-in-jwt","title":"Keycloak improper access control for disabled users in JWT authorization grant","severity":"high","exploited":false,"published_at":"2026-07-16T01:16:30.38+00:00","url":"https://junglewise.ai/threats/cve-2026-1609-keycloak-improper-access-control-for-disabled-users-in-jwt"},{"cve":"CVE-2026-4629","cvss":6.5,"slug":"cve-2026-4629-keycloak-privilege-escalation-via-hardcoded-role-mapper-injection","title":"Keycloak privilege escalation via hardcoded role mapper injection","severity":"medium","exploited":false,"published_at":"2026-06-30T13:18:59.35+00:00","url":"https://junglewise.ai/threats/cve-2026-4629-keycloak-privilege-escalation-via-hardcoded-role-mapper-injection"},{"cve":"CVE-2026-14209","cvss":4.3,"slug":"cve-2026-14209-keycloak-admin-ui-auth-bypass-in-brute-force-user-endpoint","title":"Keycloak Admin UI auth bypass in brute-force-user endpoint","severity":"medium","exploited":false,"published_at":"2026-06-30T13:17:10.317+00:00","url":"https://junglewise.ai/threats/cve-2026-14209-keycloak-admin-ui-auth-bypass-in-brute-force-user-endpoint"},{"cve":"CVE-2026-11800","cvss":8.1,"slug":"cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow","title":"Keycloak JWT algorithm confusion in JWT Authorization Grant flow","severity":"high","exploited":false,"published_at":"2026-06-25T22:17:00.473+00:00","url":"https://junglewise.ai/threats/cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow"},{"cve":"CVE-2026-9800","cvss":8.1,"slug":"cve-2026-9800-keycloak-policy-enforcer-authorization-bypass-via-incorrect-uri","title":"Keycloak Policy Enforcer authorization bypass via incorrect URI comparison","severity":"high","exploited":false,"published_at":"2026-06-25T17:17:04.18+00:00","url":"https://junglewise.ai/threats/cve-2026-9800-keycloak-policy-enforcer-authorization-bypass-via-incorrect-uri"},{"cve":"CVE-2026-9705","cvss":6.5,"slug":"cve-2026-9705-keycloak-security-bypass-in-client-registration-service","title":"Keycloak security bypass in client registration service","severity":"medium","exploited":false,"published_at":"2026-06-25T17:17:03.59+00:00","url":"https://junglewise.ai/threats/cve-2026-9705-keycloak-security-bypass-in-client-registration-service"},{"cve":"CVE-2026-11577","cvss":7.2,"slug":"cve-2026-11577-keycloak-privilege-escalation-in-partialimport-endpoint","title":"Keycloak privilege escalation in partialImport endpoint","severity":"high","exploited":false,"published_at":"2026-06-08T13:16:32.943+00:00","url":"https://junglewise.ai/threats/cve-2026-11577-keycloak-privilege-escalation-in-partialimport-endpoint"},{"cve":"CVE-2026-9088","cvss":3.1,"epss":0.0045,"slug":"cve-2026-9088-keycloak-information-disclosure-via-user-profile-permission-bypass","title":"Keycloak information disclosure via user profile permission bypass in group members endpoint","severity":"low","exploited":false,"published_at":"2026-06-05T08:16:30.99+00:00","url":"https://junglewise.ai/threats/cve-2026-9088-keycloak-information-disclosure-via-user-profile-permission-bypass"},{"cvss":7.3,"slug":"keycloak-privilege-escalation-in-fine-grained-admin-permissions-scope-ac845052","title":"Keycloak privilege escalation in Fine-Grained Admin Permissions scope mapping","severity":"high","exploited":false,"published_at":"2026-05-28T06:31:09+00:00","url":"https://junglewise.ai/threats/keycloak-privilege-escalation-in-fine-grained-admin-permissions-scope-ac845052"},{"cve":"CVE-2026-9803","cvss":5.3,"epss":0.0072,"slug":"cve-2026-9803-red-hat-keycloak-denial-of-service-in-clientregistrationauth","title":"Red Hat Keycloak denial of service in ClientRegistrationAuth","severity":"medium","exploited":false,"published_at":"2026-05-28T06:16:29.75+00:00","url":"https://junglewise.ai/threats/cve-2026-9803-red-hat-keycloak-denial-of-service-in-clientregistrationauth"},{"cve":"CVE-2026-9801","cvss":4.9,"epss":0.009,"slug":"cve-2026-9801-keycloak-denial-of-service-via-malformed-ldap-password-policy","title":"Keycloak denial of service via malformed LDAP password policy response","severity":"medium","exploited":false,"published_at":"2026-05-28T06:16:29.493+00:00","url":"https://junglewise.ai/threats/cve-2026-9801-keycloak-denial-of-service-via-malformed-ldap-password-policy"},{"cve":"CVE-2026-9798","cvss":4.3,"epss":0.0049,"slug":"cve-2026-9798-keycloak-brute-force-protection-bypass-in-ciba-flow","title":"Keycloak brute-force protection bypass in CIBA flow","severity":"medium","exploited":false,"published_at":"2026-05-28T06:16:29.33+00:00","url":"https://junglewise.ai/threats/cve-2026-9798-keycloak-brute-force-protection-bypass-in-ciba-flow"},{"cve":"CVE-2026-9796","cvss":6.5,"epss":0.0038,"slug":"cve-2026-9796-keycloak-privilege-escalation-via-toctou-in-admin-role-checks","title":"Keycloak privilege escalation via TOCTOU in admin role checks","severity":"medium","exploited":false,"published_at":"2026-05-28T05:16:41.153+00:00","url":"https://junglewise.ai/threats/cve-2026-9796-keycloak-privilege-escalation-via-toctou-in-admin-role-checks"},{"cve":"CVE-2026-9795","cvss":7.3,"epss":0.0049,"slug":"cve-2026-9795-keycloak-privilege-escalation-in-fine-grained-admin-permissions","title":"Keycloak privilege escalation in Fine-Grained Admin Permissions","severity":"high","exploited":false,"published_at":"2026-05-28T05:16:41.003+00:00","url":"https://junglewise.ai/threats/cve-2026-9795-keycloak-privilege-escalation-in-fine-grained-admin-permissions"},{"cve":"CVE-2026-9794","cvss":5.3,"epss":0.0058,"slug":"cve-2026-9794-keycloak-information-disclosure-in-saml-ecp-endpoint","title":"Keycloak information disclosure in SAML ECP endpoint","severity":"medium","exploited":false,"published_at":"2026-05-28T05:16:40.847+00:00","url":"https://junglewise.ai/threats/cve-2026-9794-keycloak-information-disclosure-in-saml-ecp-endpoint"}],"vendor":{"hub":true,"name":"Keycloak","slug":"keycloak","homepage":"https://www.keycloak.org/","description":"An open-source identity and access management solution.","url":"https://junglewise.ai/threats/vendors/keycloak"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":1}],"most_severe":[{"cve":"CVE-2026-1486","cvss":8.8,"epss":0.0046,"slug":"cve-2026-1486-keycloak-improper-security-check-for-disabled-identity-providers","title":"Keycloak improper security check for disabled Identity Providers","severity":"high","exploited":false,"published_at":"2026-02-09T20:15:55.717+00:00","url":"https://junglewise.ai/threats/cve-2026-1486-keycloak-improper-security-check-for-disabled-identity-providers"},{"cve":"CVE-2026-2603","cvss":8.1,"epss":0.0072,"slug":"cve-2026-2603-keycloak-saml-broker-authentication-bypass-via-disabled-identity","title":"Keycloak SAML broker authentication bypass via disabled Identity Provider","severity":"high","exploited":false,"published_at":"2026-03-18T02:16:24.813+00:00","url":"https://junglewise.ai/threats/cve-2026-2603-keycloak-saml-broker-authentication-bypass-via-disabled-identity"},{"cve":"CVE-2026-7504","cvss":8.1,"epss":0.005,"slug":"cve-2026-7504-red-hat-keycloak-open-redirect-via-url-validation-bypass","title":"Red Hat Keycloak open redirect via URL validation bypass","severity":"high","exploited":false,"published_at":"2026-05-19T12:16:19.553+00:00","url":"https://junglewise.ai/threats/cve-2026-7504-red-hat-keycloak-open-redirect-via-url-validation-bypass"},{"cve":"CVE-2026-1609","cvss":8.1,"slug":"cve-2026-1609-keycloak-improper-access-control-for-disabled-users-in-jwt","title":"Keycloak improper access control for disabled users in JWT authorization grant","severity":"high","exploited":false,"published_at":"2026-07-16T01:16:30.38+00:00","url":"https://junglewise.ai/threats/cve-2026-1609-keycloak-improper-access-control-for-disabled-users-in-jwt"},{"cve":"CVE-2026-11800","cvss":8.1,"slug":"cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow","title":"Keycloak JWT algorithm confusion in JWT Authorization Grant flow","severity":"high","exploited":false,"published_at":"2026-06-25T22:17:00.473+00:00","url":"https://junglewise.ai/threats/cve-2026-11800-keycloak-jwt-algorithm-confusion-in-jwt-authorization-grant-flow"},{"cve":"CVE-2026-9800","cvss":8.1,"slug":"cve-2026-9800-keycloak-policy-enforcer-authorization-bypass-via-incorrect-uri","title":"Keycloak Policy Enforcer authorization bypass via incorrect URI comparison","severity":"high","exploited":false,"published_at":"2026-06-25T17:17:04.18+00:00","url":"https://junglewise.ai/threats/cve-2026-9800-keycloak-policy-enforcer-authorization-bypass-via-incorrect-uri"},{"cve":"CVE-2026-2092","cvss":7.7,"epss":0.0031,"slug":"cve-2026-2092-keycloak-improper-validation-of-encrypted-saml-assertions","title":"Keycloak improper validation of encrypted SAML assertions","severity":"high","exploited":false,"published_at":"2026-03-18T02:16:24.577+00:00","url":"https://junglewise.ai/threats/cve-2026-2092-keycloak-improper-validation-of-encrypted-saml-assertions"},{"cvss":7.7,"slug":"keycloak-improper-validation-of-encrypted-saml-assertions-4f23627a","title":"Keycloak improper validation of encrypted SAML assertions","severity":"high","exploited":false,"published_at":"2026-03-18T03:32:09+00:00","url":"https://junglewise.ai/threats/keycloak-improper-validation-of-encrypted-saml-assertions-4f23627a"},{"cve":"CVE-2026-7307","cvss":7.5,"epss":0.0087,"slug":"cve-2026-7307-keycloak-denial-of-service-in-saml-endpoint","title":"Keycloak denial of service in SAML endpoint","severity":"high","exploited":false,"published_at":"2026-05-19T12:16:19.423+00:00","url":"https://junglewise.ai/threats/cve-2026-7307-keycloak-denial-of-service-in-saml-endpoint"},{"cve":"CVE-2026-7507","cvss":7.5,"epss":0.0076,"slug":"cve-2026-7507-keycloak-session-fixation-in-login-actions-endpoints","title":"Keycloak session fixation in login-actions endpoints","severity":"high","exploited":false,"published_at":"2026-05-19T12:16:19.687+00:00","url":"https://junglewise.ai/threats/cve-2026-7507-keycloak-session-fixation-in-login-actions-endpoints"}],"generated_at":"2026-09-26T15:07:00.181821+00:00","technologies":[{"name":"Keycloak","slug":"keycloak","vulnerabilities":53,"url":"https://junglewise.ai/threats/technologies/keycloak"}]}