Keycloak vulnerabilitiesRanked by how likely they are to be used.
Keycloak is made by Red Hat. We track 95 published vulnerabilities listed under that exact name, across 144 versions. None of them is on the list of flaws known to be exploited today. Red Hat lists newer releases under their own names, such as Keycloak Node.js Adapter, so check those pages too.
We keep watching the known-exploited list.
Is Keycloak listed under other names? Yes.
Red Hat also lists Keycloak under more specific names, such as Keycloak Node.js Adapter and Keycloak Operator. Flaws listed only under those names are counted on their own pages, not here. If you run one of these, open its page for its own exploited flaws.
Which Keycloak vulnerabilities are being exploited?
This is the list that matters most: flaws criminals are using now.
None of Keycloak's published vulnerabilities is on the list of flaws known to be exploited today. We keep watching that list.
Which Keycloak flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 94%CVE-2023-48795Medium
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension...
- 70%CVE-2020-10770Medium
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri.
- 37%CVE-2021-20323Medium
A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak.
- 18%CVE-2020-27838Medium
A flaw was found in keycloak in versions prior to 13.0.0.
- 5.8%CVE-2022-3782Critical
keycloak: path traversal via double URL encoding.
- 3.1%CVE-2022-0225Medium
A flaw was found in Keycloak. This flaw allows a privileged attacker to use the malicious payload as the group name while creating a new group from the admin console, leading to a stored Cross-site scripting (XSS)...
- 2.6%CVE-2016-8627Medium
admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks.
- 2.6%CVE-2020-1714High
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks.
- 2.4%CVE-2017-2582Medium
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property.
- 2.1%CVE-2021-3754Medium
A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user.
Running Keycloak? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 new flaw affects software Acme tracks
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
- Matched to
- Keycloak on Acme's software list
- What to do
- Plan in the vendor’s update
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 95 published vulnerabilities listed under the name Keycloak, across 144 versions.
None of Keycloak's vulnerabilities is on the list of flaws known to be exploited today.
Red Hat also lists Keycloak under more specific names, such as Keycloak Node.js Adapter and Keycloak Operator. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.
Create a Precursor Intelligence account and track Keycloak. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.