Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass

Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation

Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

Keycloak: keycloak: privilege escalation due to oversized subject_token jwt

Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login

Org.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant

Keycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments

Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Keycloak: cross-session email verification proof not bound to upstream identity in first-broker-login

Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak

Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.

Keycloak: keycloak: unauthorized authentication via disabled saml identity provider

Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)

Org.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation

Keycloak: group-admin escalation to realm-admin

Keycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions

Keycloak-services: keycloak-services: unauthenticated dos via unbounded locale caching

Keycloak-services: keycloak-services: saml redirect deflate helpers leak native zlib state

Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing

Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover

Keycloak: keycloak: denial of service via specially crafted saml input

Keycloak: keycloak: denial of service via excessive processing of openid connect scope parameters

Keycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw

Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass

Keycloak: keycloak: privilege escalation via improper scope mapping enforcement

Keycloak: keycloak: information disclosure due to redirect_uri validation bypass

Keycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts

Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission

Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data

Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart

Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay

Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference

Keycloak: keycloak: privilege escalation through hardcoded role mapper injection

Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token

Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition

Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass

Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak

Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled

Keycloak: incorrect ownership checks in /uma-policy/

Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

Keycloak: keycloak: denial of service via malformed authorization header

Keycloak: keycloak: information disclosure via saml ecp endpoint

Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim