Is Keycloak 24.0.1 affected?

Vulnerabilities affecting 24.0.1

• 8.8
  CVE-2026-15572 Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation fixed in 26.4.14
• 8.1
  CVE-2026-15573 Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher fixed in 26.4.14
• 8.1
  CVE-2026-16102 Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers fixed in 26.4.14
• 8.1
  CVE-2026-9800 Authorization bypass via incorrect uri comparison fixed in 26.0.10
• 8.1
  CVE-2026-11800 Authentication bypass via jwt algorithm confusion fixed in 26.6.4
• 7.7
  CVE-2026-9099 group-admin escalation to realm-admin fixed in 26.6.4
• 7.7
  CVE-2026-2092 Keycloak: Unauthorized access via improper validation of encrypted SAML assertions fixed in 26.2.14
• 7.7
  CVE-2024-8698 Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
• 7.5
  CVE-2025-11419 Keycloak TLS Client-Initiated Renegotiation Denial of Service fixed in 26.0.16
• 7.4
  CVE-2026-16442 Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction fixed in 26.4.14
• 7.4
  CVE-2026-16443 Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation fixed in 26.4.14
• 7.3
  CVE-2026-9086 Cross-site scripting (xss) via case-insensitive uri validation bypass fixed in 26.6.4
• 7.3
  CVE-2026-9795 Privilege escalation via improper scope mapping enforcement fixed in 26.6.4
• 7.1
  CVE-2024-10039 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination fixed in 24.0.9
• 7.1
  CVE-2024-7341 Session fixation in Elytron SAML adapters
• 6.8
  CVE-2025-11538 Debug default bind address fixed in 26.4.4
• 6.5
  CVE-2026-16100 Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text fixed in 26.6.5
• 6.5
  CVE-2026-9705 Attacker can re-enable and take over disabled clients via registration access token fixed in 26.6.4
• 6.5
  CVE-2024-11734 Denial of Service in Keycloak Server via Security Headers fixed in 26.0.8
• 6.5
  CVE-2024-10270 Inefficient Regular Expression Complexity in org.keycloak:keycloak-services fixed in 24.0.9
• 6.1
  CVE-2024-8883 Vulnerable Redirect URI Validation Results in Open Redirect
• 5.9
  CVE-2024-10451 Sensitive Data Exposure in Keycloak Build Process fixed in 24.0.9
• 5.5
  CVE-2025-13467 Deserialization of Untrusted Data in LDAP User Federation fixed in 26.2.11
• 5.4
  CVE-2026-16071 Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary fixed in 26.4.14
• 5.4
  CVE-2025-1391 Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims fixed in 26.0.10
• 5.4
  CVE-2025-0604 Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak fixed in 26.0.10
• 5.3
  CVE-2025-8419 Keycloak SMTP Inject Vulnerability fixed in 26.2.8
• 4.9
  CVE-2026-9083 Information disclosure through arbitrary filesystem path probing fixed in 26.6.4
• 4.9
  CVE-2025-9162 Variable resolution on imports can expose environment variables fixed in 26.2.9
• 4.9
  CVE-2024-11736 Unrestricted admin use of system and environment variables fixed in 26.0.8
• 4.8
  CVE-2024-7318 One Time Passcode (OTP) is valid longer than expiration timeSeverity
• 4.7
  CVE-2024-9666 Keycloak proxy header handling Denial-of-Service (DoS) vulnerability fixed in 24.0.9
• 4.6
  CVE-2026-9799 Unauthorized access to resources via uma permission ticket bypass fixed in 26.6.4
• 4.3
  CVE-2025-10044 Keycloak error_description injection on error pages that can trigger phishing attacks fixed in 26.2.9
• 3.7
  CVE-2025-10939 Unable to restrict access to the admin console fixed in 26.4.4
• 2.7
  CVE-2024-10492 Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path fixed in 24.0.9
• 2.7
  CVE-2024-5967 Leak of configured LDAP bind credentials through the Keycloak admin console
• medium
  CVE-2025-7365 Phishing attack via email verification step in first login flow fixed in 26.0.13
• high
  CVE-2025-3501 Keycloak hostname verification fixed in 26.2.2
• medium
  CVE-2025-3910 Two factor authentication bypass fixed in 26.2.2
• medium
  CVE-2024-4629 Potential bypass of brute force protection fixed in 24.0.7
• medium
  CVE-2024-3656 Unguarded admin REST API endpoints allows low privilege users to use administrative functionalities fixed in 24.0.5
• high
  CVE-2024-4540 Exposure of sensitive information in Pushed Authorization Requests (PAR) fixed in 24.0.5
• medium
  CVE-2023-3597 Secondary factor bypass in step-up authentication fixed in 24.0.3
• medium
  CVE-2023-6544 Authorization Bypass fixed in 24.0.3
• high
  CVE-2024-2419 Path traversal in the redirect validation fixed in 24.0.3
• high
  CVE-2023-6717 XSS via assertion consumer service URL in SAML POST-binding flow fixed in 24.0.3
• low
  CVE-2023-0657 Impersonation via logout token exchange fixed in 24.0.3
• medium
  CVE-2023-6787 Session hijacking via re-authentication fixed in 24.0.3
• high
  CVE-2024-1132 Path transversal in redirection validation fixed in 24.0.3
• high
  CVE-2024-1249 Unvalidated cross-origin messages in checkLoginIframe leads to DDoS fixed in 24.0.3

Newer releases