Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login

Org.keycloak.protocol.services: keycloak hostname verification

Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

Keycloak: keycloak: denial of service via specially crafted saml input

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

Keycloak: keycloak tls client-initiated renegotiation denial of service

Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

Keycloak: keycloak: information disclosure due to redirect_uri validation bypass

Keycloak: phishing attack via email verification step in first login flow

Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)

Org.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id

Org.keycloak.storage.ldap: keycloak: deserialization of untrusted data in ldap user federation

Keycloak: incorrect ownership checks in /uma-policy/

Keycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed

Keycloak-server: too long and not settings compliant session

Keycloak: keycloak: replay of action tokens via improper handling of single-use entries

Org.keycloak/keycloak-services: keycloak smtp inject vulnerability

Org.keycloak/keycloak-model-storage-service: variable injection into environment variables

Keycloak: keycloak error_description injection on error pages

Org.keycloak/keycloak-services: webauthn attestation statement verification bypass