Known vulnerabilities in Keycloak

Vendor: Keycloak
Software: Keycloak
Software CPE: cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*
Total vulnerabilities: 236
Public exploits: 6
Known exploited (KEV): 0

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Keycloak Keycloak is affected by 236 known vulnerabilities: 10 high, 99 medium, 127 low Critical High Medium Low

Vulnerabilities (236)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU150839 - Missing release of memory after effective lifetime
CVE-2026-18212
CWE-401 Medium
No
No
26.7.4 18.09.2026 SB2026091847
SB20260921141
#VU150838 - Missing Authorization
CVE-2026-17526
CWE-862 Low
No
No
26.7.4 18.09.2026 SB2026091847
SB20260921141
#VU150837 - Improper Authentication
CVE-2026-19607
CWE-287 Medium
No
No
26.7.4 18.09.2026 SB2026091847
SB20260921141
#VU150836 - Missing Authorization
CVE-2026-74909
CWE-862 Medium
No
No
26.7.4 18.09.2026 SB2026091847
SB20260921141
#VU150835 - Resource exhaustion
CVE-2026-79651
CWE-400 Medium
No
No
26.7.4 18.09.2026 SB2026091847
SB20260921141
#VU150790 - Incorrect Comparison
CVE-2026-90997
CWE-697 Medium
No
No
26.7.4 18.09.2026 SB2026091847
#VU148959 - Predictable from Observable State
CVE-2026-15571
CWE-341 Low
No
No
26.7.2 10.09.2026 SB2026090152
SB2026091076
SB2026091144
#VU148958 - Exposure of sensitive information to an unauthorized actor
CVE-2026-17048
CWE-200 Low
No
No
26.7.2 10.09.2026 SB2026090152
SB2026091076
SB2026091144
#VU148957 - Authorization Bypass Through User-Controlled Key
CVE-2026-15945
CWE-639 Low
No
No
26.7.2 10.09.2026 SB2026090152
SB2026091076
#VU148956 - Insufficient Granularity of Access Control
CVE-2026-14613
CWE-1220 Low
No
No
26.7.2 10.09.2026 SB2026090152
SB2026091076
SB2026091144
#VU148946 - Improper Validation of Syntactic Correctness of Input
CVE-2026-7307
CWE-1286 Medium
No
No
26.6.2 10.09.2026 SB2026091072
SB2026091074
SB2026091075
#VU148945 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-37980
CWE-79 Low
No
No
26.5.6, 26.6.2 10.09.2026 SB2026091072
#VU148944 - Improper Access Control
CVE-2026-4628
CWE-284 Low
No
No
26.6.2 10.09.2026 SB2026091072
#VU146635 - Weak password recovery mechanism
CVE-2026-18963
CWE-640 High
Available
No
26.4.15, 26.6.6, 26.7.2 01.09.2026 SB2026090152
SB2026090158
SB2026090159
and 2 more
#VU139152 - Improperly Controlled Modification of Dynamically-Determined Object Attributes
CVE-2026-59888
CWE-915 Medium
No
No
26.7.2 22.07.2026 SB2026072278
SB2026072413
SB20260728138
and 10 more
#VU139151 - Incorrect Authorization
CVE-2026-59889
CWE-863 Low
No
No
26.7.2 22.07.2026 SB2026072278
SB2026072413
SB20260728138
and 10 more
#VU138924 - Allocation of Resources Without Limits or Throttling
CVE-2026-45292
CWE-770 Low
No
No
26.7.2 21.07.2026 SB20260721100
SB2026083158
SB2026090152
and 2 more
#VU132260 - Use of a Broken or Risky Cryptographic Algorithm
CVE-2026-5588
CWE-327 Medium
No
No
26.6.2 25.05.2026 SB2026052529
SB2026052531
SB2026052540
and 18 more
#VU124423 - Allocation of Resources Without Limits or Throttling
CVE-2026-33871
CWE-770 Medium
No
No
26.6.2 25.03.2026 SB2026032533
SB20260415180
SB20260422237
and 17 more
#VU124422 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
CVE-2026-33870
CWE-444 Medium
Available
No
26.6.2 25.03.2026 SB2026032533
SB20260415180
SB2026042043
and 23 more


Showing elements 1 - 20 out of 236