Org.keycloak:keycloak-parent
25 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Org.keycloak:keycloak-parent, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.
Org.keycloak:keycloak-parent CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 1 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 25 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical2
- High11
- Medium9
- Low2
Latest CVEs
The 15 most recently published vulnerabilities affecting Org.keycloak:keycloak-parent.
- CVE-2026-0707Keycloak: keycloak authorization header parsing leading to potential security control bypass5.3
- CVE-2022-4137Keycloak: reflected xss attack8.1
- CVE-2022-3916Keycloak: session takeover with oidc offline refreshtokens6.8
- CVE-2022-3782keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicio...9.1
- CVE-2022-2256A Stored Cross-site scripting (XSS) vulnerability was found in keycloak as shipped in Red Hat Single Sign-On 7. This flaw allows a privileged attacker to execute malicious scripts in the admin cons...3.8
- CVE-2021-3513A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are ent...7.5
- CVE-2022-2668An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled7.2
- GHSA-m98g-63qj-fp8jReflected XSS on clients-registrations endpoint—
- CVE-2021-3461A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].7.1
- CVE-2021-20222A flaw was found in keycloak. The new account console in keycloak can allow malicious code to be executed using the referrer URL. The highest threat from this vulnerability is to data confidentiali...7.5
- CVE-2020-1717A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.2.7
- CVE-2020-1725A flaw was found in keycloak before version 13.0.0. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access ...5.4
- CVE-2020-14366A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the...6.8
- CVE-2020-1694A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive informatio...4.9
- CVE-2020-10748A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or fu...6.1
Product grouping is registry-driven, with AI assist and human review. How it works