Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart

Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

Keycloak-services: keycloak-services: client access-type policy condition bypass during client update

Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes

Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2

Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token

Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability

Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition

Keycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired

Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed

Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled

Keycloak-services: keycloak-services: broker-originated username collision causes account lockout

Keycloak: keycloak: denial of service via malformed authorization header

Keycloak: keycloak: information disclosure via saml ecp endpoint

Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim

Keycloak-services: keycloak-services: incomplete fix for arbitrary filesystem path probing via keystore parameters

Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

Keycloak: keycloak: information disclosure through arbitrary filesystem path probing

Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak

Keycloak: keycloak: denial of service via malformed ldap password policy response

Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check

Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass

Keycloak-admin-ui: keycloak-admin-ui:admin ui extension brute-force-user endpoint bypasses fgapv2 user view restrictions

Keycloak: keycloak: brute-force protection bypass in ciba flow

Keycloak-rhel9: organization data leak after feature disabled in keycloak

Keycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation

Keycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-604