KE
Product
Keycloak
98
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 34Medium 53Low 6
Watch
Add Keycloak to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-0091 | 3.8 | Jan 13 | A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow Affected: All versions, or not specified |
| CVE-2019-3868 | 3.8 | Apr 24 | Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC Affected: through 6.0.0 |
| CVE-2020-10734 | 3.3 | Feb 11 | A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection Affected: All versions, or not specified |
| CVE-2025-12150 | 3.1 | Feb 27 | Org.keycloak/keycloak-services: webauthn attestation statement verification bypass Affected: 24.0.2 |
| CVE-2025-5416 | 2.7 | Jun 20 | A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure Affected: All versions, or not specified |
| CVE-2020-1717 | 2.7 | Feb 11 | A flaw was found in Keycloak 7.0.1 Affected: 7.0.1 |
Showing 6