Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 98
Reset filtersKeycloak Admin REST API exposes backend schema and rules
Keycloak services allows the issuance of access and refresh tokens for disabled users
Keycloak does not validate and update refresh token usage atomically
Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions
Keycloak vulnerable to session takeovers due to reuse of session identifiers
Keycloak does not invalidate sessions when "Remember Me" is disabled
Keycloak does not invalidate offline sessions when the offline_access scope is removed
Keycloak SMTP Inject Vulnerability
Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)
Keycloak phishing attack via email verification step in first login flow
Keycloak vulnerable to two factor authentication bypass
Keycloak hostname verification
Keycloak Denial of Service (DoS) Vulnerability via JWT Token Cache
Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
org.keycloak:keycloak-services has Inefficient Regular Expression Complexity
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect
Keycloak Services has a potential bypass of brute force protection
Keycloak has session fixation in Elytron SAML adapters
Keycloak Denial of Service via account lockout
Keycloak's improper input validation allows using email as username
Keycloak's admin API allows low privilege users to use administrative functions
Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
Keycloak vulnerable to impersonation via logout token exchange
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.