Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart

Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay

Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference

Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

Keycloak-services: keycloak-services: client access-type policy condition bypass during client update

Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes

Keycloak-services: keycloak-services: group policy extendchildren matches sibling group path prefixes

Keycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim

Keycloak-services: keycloak-services: client policy source-group condition bypass via duplicate group name matching

Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter

Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins

Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2

Keycloak-broker: keycloak: privilege escalation to realm administrator via improper authorization in identity provider mapper

Keycloak: keycloak: privilege escalation through hardcoded role mapper injection

Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token

Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnerability

Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition

Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass

Org.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)

Keycloak: potential bypass of brute force protection

A misconfiguration flaw was found in Keycloak

Keycloak-core: open redirect on account page

Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session

Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak

Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations

Keycloak-services: keycloak-services: oidc idp update reuses masked client secret after token url change

Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed

Keycloak-services: keycloak-services: secure-client-uris policy bypass via localhost-prefixed domains

Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero

Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers

Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource

Org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services

Org.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled

Org.keycloak.authentication: two factor authentication bypass

Keycloak: keycloak: denial of service via malformed authorization header

Keycloak: keycloak: information disclosure via saml ecp endpoint

Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim

Keycloak: keycloak: replay of action tokens via improper handling of single-use entries

Keycloak: keycloak: denial of service due to excessive samlrequest decompression

Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints

Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api

Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles

Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation

Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission

Keycloak: keycloak: information disclosure through arbitrary filesystem path probing

Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak

Keycloak: keycloak: denial of service via malformed ldap password policy response

Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api

Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators