Keycloak vulnerabilities
We track 4 vulnerabilities in Keycloak products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on September 17, 2026.
Latest Keycloak vulnerabilities
- 7.4 High severity
Keycloak: Authentication Bypass by Capture-replay
A flaw was found in Keycloak. When deployed in stateless mode with MySQL or MariaDB, a mismatch in row-count semantics between the database driver and Keycloak's application logic allows an attacker to bypass replay protection. This vulnerability enables an at
- 8.1 High severity
Keycloak: Improper Access Control
A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with l
- 8.8 High severity
keycloak: Cleartext Transmission of Sensitive Information
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile. When a user registers itself through registration flow, the "password" and "password-confirm" field from the form will occur as regular user attributes. All users and clients
- 9.8 Critical severity
keycloak: Authorization Bypass Through User-Controlled Key
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the client_id of the target. This could allow a