Is Keycloak 15.1.1 affected?

Vulnerabilities affecting 15.1.1

• 8.8
  CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation fixed in 26.4.14
• 8.7
  CVE-2023-0264 User impersonation via stolen UUID code fixed in 21.0.1
• 8.1
  CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher fixed in 26.4.14
• 8.1
  CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers fixed in 26.4.14
• 8.1
  CVE-2026-9800 Authorization bypass via incorrect uri comparison fixed in 26.0.10
• 8.1
  CVE-2026-11800 Authentication bypass via jwt algorithm confusion fixed in 26.6.4
• 7.7
  CVE-2026-9099 group-admin escalation to realm-admin fixed in 26.6.4
• 7.7
  CVE-2026-2092 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions fixed in 26.2.14
• 7.7
  CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
• 7.5
  CVE-2025-11419 Keycloak TLS Client-Initiated Renegotiation Denial of Service fixed in 26.0.16
• 7.4
  CVE-2026-16442 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction fixed in 26.4.14
• 7.4
  CVE-2026-16443 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation fixed in 26.4.14
• 7.3
  CVE-2026-9086 Cross-site scripting (xss) via case-insensitive uri validation bypass fixed in 26.6.4
• 7.3
  CVE-2026-9795 Privilege escalation via improper scope mapping enforcement fixed in 26.6.4
• 7.1
  CVE-2024-10039 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination fixed in 24.0.9
• 7.1
  CVE-2024-7341 Session fixation in Elytron SAML adapters
• 7.1
  CVE-2023-6291 The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted fixed in 23.0.3
• 7.1
  CVE-2023-2422 Improper Client Certificate Validation for OAuth/OpenID clients fixed in 21.1.2
• 6.8
  CVE-2025-11538 Debug default bind address fixed in 26.4.4
• 6.5
  CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text fixed in 26.6.5
• 6.5
  CVE-2026-9705 Attacker can re-enable and take over disabled clients via registration access token fixed in 26.6.4
• 6.5
  CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers fixed in 26.0.8
• 6.5
  CVE-2024-10270 Inefficient Regular Expression Complexity in org.keycloak:keycloak-services fixed in 24.0.9
• 6.1
  CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect
• 5.9
  CVE-2024-10451 Sensitive Data Exposure in Keycloak Build Process fixed in 24.0.9
• 5.5
  CVE-2025-13467 Deserialization of Untrusted Data in LDAP User Federation fixed in 26.2.11
• 5.4
  CVE-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary fixed in 26.4.14
• 5.4
  CVE-2025-1391 Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims fixed in 26.0.10
• 5.4
  CVE-2025-0604 Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak fixed in 26.0.10
• 5.3
  CVE-2025-8419 Keycloak SMTP Inject Vulnerability fixed in 26.2.8
• 4.9
  CVE-2026-9083 Information disclosure through arbitrary filesystem path probing fixed in 26.6.4
• 4.9
  CVE-2025-9162 Variable resolution on imports can expose environment variables fixed in 26.2.9
• 4.9
  CVE-2024-11736 Unrestricted admin use of system and environment variables fixed in 26.0.8
• 4.8
  CVE-2024-7318 One Time Passcode (OTP) is valid longer than expiration timeSeverity
• 4.7
  CVE-2024-9666 Keycloak proxy header handling Denial-of-Service (DoS) vulnerability fixed in 24.0.9
• 4.6
  CVE-2026-9799 Unauthorized access to resources via uma permission ticket bypass fixed in 26.6.4
• 4.3
  CVE-2025-10044 Keycloak error_description injection on error pages that can trigger phishing attacks fixed in 26.2.9
• 3.7
  CVE-2025-10939 Unable to restrict access to the admin console fixed in 26.4.4
• 2.7
  CVE-2024-10492 Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path fixed in 24.0.9
• 2.7
  CVE-2024-5967 Leak of configured LDAP bind credentials through the Keycloak admin console
• medium
  CVE-2025-7365 Phishing attack via email verification step in first login flow fixed in 26.0.13
• high
  CVE-2025-3501 Keycloak hostname verification fixed in 26.2.2
• medium
  CVE-2025-3910 Two factor authentication bypass fixed in 26.2.2
• medium
  CVE-2024-4629 Potential bypass of brute force protection fixed in 22.0.12
• low
  CVE-2021-3754 Improper input validation on Keycloak allows using email as username fixed in 24.0.1
• low
  CVE-2024-1722 DoS via account lockout fixed in 24.0.0
• medium
  CVE-2024-3656 Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities fixed in 24.0.5
• high
  CVE-2024-4540 Exposure of sensitive information in Pushed Authorization Requests (PAR) fixed in 24.0.5
• medium
  CVE-2023-3597 Secondary factor bypass in step-up authentication fixed in 22.0.10
• medium
  CVE-2023-6544 Authorization Bypass fixed in 22.0.10
• high
  CVE-2024-2419 Path traversal in the redirect validation fixed in 22.0.10
• high
  CVE-2023-6717 XSS via assertion consumer service URL in SAML POST-binding flow fixed in 22.0.10
• low
  CVE-2023-0657 Impersonation via logout token exchange fixed in 22.0.10
• medium
  CVE-2023-6787 Session hijacking via re-authentication fixed in 22.0.10
• high
  CVE-2024-1132 Path transversal in redirection validation fixed in 22.0.10
• high
  CVE-2024-1249 Unvalidated cross-origin messages in checkLoginIframe leads to DDoS fixed in 22.0.10
• low
  CVE-2023-6484 Log Injection during WebAuthn authentication or registration fixed in 22.0.9
• medium
  CVE-2023-6927 keycloak-core: open redirect via "form_post.jwt" JARM response mode fixed in 23.0.4
• medium
  CVE-2023-6134 Reflected XSS via wildcard in OIDC redirect_uri fixed in 23.0.3
• low
  CVE-2022-2232 LDAP Injection on UsernameForm Login fixed in 23.0.1
• medium
  CVE-2023-0105 Impersonation and lockout possible through incorrect handling of email trust fixed in 22.0.1
• medium
  CVE-2023-2585 Client Spoofing within the Keycloak Device Authorisation Grant fixed in 21.1.2
• low
  CVE-2023-1664 Untrusted Certificate Validation fixed in 21.1.2
• low
  CVE-2022-4361 Cross-site scripting when validating URI-schemes on SAML and OIDC fixed in 21.1.2
• medium
  CVE-2022-1274 HTML Injection in Keycloak Admin REST API fixed in 20.0.5
• medium
  CVE-2022-1438 XSS on impersonation under specific circumstances fixed in 20.0.5
• high
  CVE-2022-4137 Reflected XSS on OpenID connect login service fixed in 20.0.5
• low
  CVE-2023-0091 Lack of validation of access token on client registrations endpoint fixed in 20.0.3
• high
  CVE-2022-3782 Path traversal via double URL encoding fixed in 20.0.2
• medium
  CVE-2022-3916 Session takeover with OIDC offline refreshtokens fixed in 20.0.2
• medium
  CVE-2022-0225 Stored XSS in groups dropdown fixed in 20.0.0
• low
  CVE-2022-2668 SAML javascript protocol mapper: Uploading of scripts through admin console fixed in 19.0.2
• medium
  CVE-2022-2256 Stored XSS when loading default roles fixed in 19.0.2
• medium
  CVE-2021-20323 Reflected XSS on clients-registrations endpoint fixed in 18.0.0
• low
  CVE-2020-10734 OIDC Logout redirects can happen even if no id_token_hint is provided fixed in 18.0.0
• medium
  CVE-2021-3827 ECP SAML binding bypasses authentication flows fixed in 18.0.0
• low
  CVE-2021-3424 Keycloak is vulnerable to IDN homograph attack fixed in 18.0.0
• medium
  CVE-2022-1245 Privilege escalation vulnerability on Token Exchange feature fixed in 18.0.0
• high
  CVE-2021-4133 Incorrect authorization allows unpriviledged users to create other users fixed in 16.0.0

Newer releases