Known vulnerabilities in Keycloak

Vendor: Keycloak
Software: Keycloak
Software CPE: cpe:2.3:a:keycloak:keycloak:*:*:*:*:*:*:*:*
Total vulnerabilities: 130
Public exploits: 4
Known exploited (KEV): 0
Highest CVSSv4 Score: 9.3

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Keycloak Keycloak is affected by 130 known vulnerabilities: 7 high, 63 medium, 60 low Critical High Medium Low

Vulnerabilities (130)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU141174 - Improper Authorization
CVE-2026-15573
CWE-285 Medium
No
No
26.4.14, 26.6.5, 26.7.1 06.08.2026 SB20260806121
#VU141173 - Type confusion
CVE-2026-15572
CWE-843 Medium
No
No
26.4.14, 26.6.5, 26.7.1 06.08.2026 SB20260806121
#VU141172 - Resource exhaustion
CVE-2026-16100
CWE-400 Low
No
No
26.4.14, 26.6.5, 26.7.1 06.08.2026 SB20260806121
#VU141171 - Origin Validation Error
CVE-2026-16442
CWE-346 Medium
No
No
26.4.14, 26.6.5, 26.7.1 06.08.2026 SB20260806121
#VU141170 - Improper Verification of Cryptographic Signature
CVE-2026-16443
CWE-347 Medium
No
No
26.4.14, 26.6.5, 26.7.1 06.08.2026 SB20260806121
#VU141169 - Improper input validation
CVE-2026-16071
CWE-20 Low
No
No
26.4.14, 26.6.5, 26.7.1 06.08.2026 SB20260806121
#VU141168 - Improper input validation
CVE-2026-16102
CWE-20 Medium
No
No
26.4.14, 26.6.5, 26.7.1 06.08.2026 SB20260806121
#VU135697 - Authorization Bypass Through User-Controlled Key
CVE-2026-9099
CWE-639 Low
No
No
26.6.4 29.06.2026 SB2026062907
#VU135696 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVE-2026-9083
CWE-22 Low
No
No
26.6.4 29.06.2026 SB2026062907
#VU135693 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-9086
CWE-79 Low
No
No
26.6.4 29.06.2026 SB2026062907
#VU135692 - Insufficient Session Expiration
CVE-2026-9705
CWE-613 Medium
No
No
26.6.4 29.06.2026 SB2026062907
#VU135691 - Incorrect Privilege Assignment
CVE-2026-9795
CWE-266 Low
No
No
26.6.4 29.06.2026 SB2026062907
#VU135690 - Authorization Bypass Through User-Controlled Key
CVE-2026-9799
CWE-639 Low
No
No
26.6.4 29.06.2026 SB2026062907
#VU135687 - Improper Verification of Cryptographic Signature
CVE-2026-11800
CWE-347 Medium
No
No
26.6.4 29.06.2026 SB2026062907
#VU133121 - Improper Validation of Specified Type of Input
CVE-2026-2092
CWE-1287 Low
No
No
26.2.14, 26.4.10, 26.5.5, 26.6.0 01.06.2026 SB2026060134
#VU118800 - Deserialization of Untrusted Data
CVE-2025-13467
CWE-502 Low
No
No
26.2.11, 26.4.6 27.11.2025 SB2025112714
SB2025112715
SB2025112716
and 1 more
#VU118581 - Configuration
CVE-2025-11538
CWE-16 Medium
No
No
26.4.4 18.11.2025 SB2025111839
SB2025111840
SB2025111841
#VU118578 - Improper Authentication
CVE-2025-12150
CWE-287 Low
No
No
26.4.4 18.11.2025 SB2025111839
SB2025111840
SB2025111841
#VU118576 - Protection Mechanism Failure
CVE-2025-10939
CWE-693 Low
No
No
26.4.4 18.11.2025 SB2025111839
SB2025111840
SB2025111841
#VU118575 - Session Fixation
CVE-2025-12390
CWE-384 Low
No
No
26.4.4 18.11.2025 SB2025111839
SB2025111840
SB2025111841


Showing elements 1 - 20 out of 130