Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 98
Reset filtersKeycloak: Unauthorized access via improper validation of encrypted SAML assertions
Keycloak has privilege escalation via improper scope mapping enforcement
Keycloak: Information disclosure due to user profile permission bypass
Keycloak has Insufficient Session Expiration
Keycloak has an Out-of-bounds Read
Keycloak has an Authentication Bypass by Primary Weakness
Keycloak has an Improper Verification of Cryptographic Signature issue
Keycloak Vulnerable to Incorrect Authorization
Keycloak Generates an Error Message Containing Sensitive Information
Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege
Keycloak Vulnerable to Improper Validation of Specified Quantity in Input
Keycloak Services has Improper Validation of Consistency within Input
Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromise
Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
Keycloak: Session fixation in OIDC login flow that can lead to account takeover
Keycloak: Access token disclosure and implicit flow bypass via forged client data
Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers
Keycloak Account Resources user lookup contains broken access control
Keycloak: Unauthorized account takeover via WebAuthn token replay
Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass
Keycloak: Information Disclosure via evaluate-scopes Admin API
Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured
Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.