Keycloak is an open-source identity and access-management platform whose vulnerability profile, though concentrated in a single product line, reflects its deployment across authentication and authorization boundaries in enterprise and cloud architectures. Vulnerabilities affecting the platform skew toward serious outcomes and recur through weakness classes centered on HTTP request handling, input validation, and client-side security enforcement—categories that are characteristic of web-facing identity services where parsing and trust-boundary flaws propagate to downstream applications. Defenders should prioritize Keycloak advisories in authentication-dependent infrastructure; live severity and current exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Keycloak over time
Signals from CVEs in this vendor scope (6 CVEs).
6 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-7474CRITICAL It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restr | May 12, 2017 | 9.8 | 30 | NO | NO |
CVE-2017-12161HIGH It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to c | Feb 21, 2018 | 8.8 | 26 | NO | NO |
CVE-2014-3651HIGH JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR | Dec 29, 2017 | 7.5 | 24 | NO | NO |
CVE-2017-12159HIGH It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, l | Oct 26, 2017 | 7.5 | 22 | NO | NO |
CVE-2014-3709HIGH The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks | Oct 18, 2017 | 8.8 | 22 | NO | NO |
CVE-2017-12158MEDIUM It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authentica | Oct 26, 2017 | 5.4 | 21 | NO | NO |
Signals from CVEs in this vendor scope (6 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Keycloak.
Media articles that mention a CVE ID that affects a product developed by Keycloak — matched by CVE ID, not by vendor name.