Security Advisories · keycloak/keycloak · GitHub

Security Advisories

View known security vulnerabilities and report new vulnerabilities privately to maintainers.

Report a vulnerability

Variable resolution on imports can expose environment variables
GHSA-8hxp-qmph-w5gq published Oct 8, 2025 by rmartinc

Moderate
Keycloak error_description injection on error pages that can trigger phishing attacks
GHSA-27gc-wj6x-9w55 published Oct 8, 2025 by rmartinc

Moderate
Keycloak SMTP Inject Vulnerability
GHSA-m4j5-5x4r-2xp9 published Sep 17, 2025 by rmartinc

Moderate
Privilege Escalation in Keycloak Admin Console (FGAPv2 Enabled)
GHSA-27gp-8389-hm4w published Jul 29, 2025 by rmartinc

Moderate
Phishing attack via email verification step in first login flow
GHSA-xhpr-465j-7p9q published Jul 29, 2025 by rmartinc

Moderate
Two factor authentication bypass
GHSA-5jfq-x6xp-7rw2 published Apr 30, 2025 by stianst

Moderate
Keycloak hostname verification
GHSA-hw58-3793-42gg published Apr 30, 2025 by stianst

High
Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
GHSA-gvgg-2r3r-53x7 published Mar 10, 2025 by rmartinc

Moderate
Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
GHSA-2p82-5wwr-43cw published Mar 10, 2025 by rmartinc

Moderate
CLI option for encrypted JGroups ignored
GHSA-g6qq-c9f9-2772 published Feb 4, 2025 by rmartinc

Moderate