WaratekVRT Sign in
Reset
More filters (2)
Columns
Protection: Full✕Product: Keycloak✕
Overview 8 matches · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
8matches 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 8 100.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 0 0.0%
Critical 2 25.0% High 3 37.5% Medium 3 37.5% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 8 100.0% partly blocked 0 0.0% not blocked 0 0.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 1 12.5% Forecast only 0 0.0% No public exploit 7 87.5%
split by peak 2 / year
Protected by Waratek: 8 Medium: 3High: 3Critical: 2 blocked by ARMR today: 8 No public exploit: 7Proof of concept only: 1
20202 Protected by Waratek2 High2 blocked by ARMR today2 No public exploit2 20210 20221 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20232 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2 20241 Protected by Waratek1 High1 blocked by ARMR today1 Proof of concept only1 20251 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1 20261 Protected by Waratek1 Medium1 blocked by ARMR today1 No public exploit1
2020202120222023202420252026
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-9083 Medium 2026-06-25 Protected by Waratek No public exploit A flaw was found in Keycloak. A realm administrator with the "manage-realm" role can exploit this vulnerability by submitting an arbitrary filesystem path as a keystore parameter when creating a key provider component. This allows the administrator to probe arbitrary filesystem paths, determining which files exist and are readable by the Keycloak process. This information disclosure could be used to identify high-value targets for follow-on attacks.
CVE-2025-13467 Medium 2025-11-25 Protected by Waratek No public exploit A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
CVE-2024-1132 High 2024-04-17 Protected by Waratek Proof of concept only A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field, and requires user interaction within the malicious URL.
CVE-2022-4361 Critical 2023-07-07 Protected by Waratek No public exploit Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.
CVE-2022-3782 Critical 2023-01-13 Protected by Waratek No public exploit keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.
CVE-2021-3856 Medium 2022-08-26 Protected by Waratek No public exploit ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.
CVE-2020-14366 High 2020-11-09 Protected by Waratek No public exploit A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw
CVE-2020-1714 High 2020-05-13 Protected by Waratek No public exploit A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.