WaratekVRT Sign in

Critical Keycloak CVEs

10 CVEs, 1 exploited, 2 protected by Waratek

Reset
More filters (1)
Columns
Product: Keycloak✕
Overview 10 matches · 2 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 0 EPSS ≥ 0.5
10matches 2protected20.0% 1exploited10.0% 0CISA KEV0.0% 1public PoC10.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 20.0% Rule in development 0 0.0% Mitigation candidate 1 10.0% No exploit published 7 70.0%
Critical 10 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 20.0% partly blocked 0 0.0% not blocked 8 80.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 10.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 9 90.0%
split by peak 3 / year
No exploit published: 7Mitigation candidate: 1Protected by Waratek: 2 Critical: 10 not blocked: 8blocked by ARMR today: 2 No public exploit: 9Exploited: 1
20191 No exploit published1 Critical1 not blocked1 No public exploit1 20202 No exploit published2 Critical2 not blocked2 No public exploit2 20211 No exploit published1 Critical1 not blocked1 No public exploit1 20221 No exploit published1 Critical1 not blocked1 No public exploit1 20232 Protected by Waratek2 Critical2 blocked by ARMR today2 No public exploit2 20240 20250 20263 Mitigation candidate1 No exploit published2 Critical3 not blocked3 Exploited1 No public exploit2
20192020202120222023202420252026
10 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-18963 Critical 2026-08-18 Mitigation candidate Exploited A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
CVE-2026-16443 Critical 2026-08-05 No exploit published No public exploit A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by knowing their external identifier.
CVE-2026-16442 Critical 2026-08-05 No exploit published No public exploit A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
CVE-2022-4361 Critical 2023-07-07 Protected by Waratek No public exploit Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.
CVE-2022-3782 Critical 2023-01-13 Protected by Waratek No public exploit keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.
CVE-2022-1245 Critical 2022-07-08 No exploit published No public exploit A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a client to gain unauthorized access to additional services.
CVE-2021-20195 Critical 2021-05-28 No exploit published No public exploit A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
CVE-2020-1731 Critical 2020-03-02 No exploit published No public exploit A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.
CVE-2019-14837 Critical 2020-01-07 No exploit published No public exploit A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.
CVE-2019-14910 Critical 2019-12-05 No exploit published No public exploit A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.