Suggestions search

Untriaged

Filter by:

With package: keycloak

Found 3 matching suggestions

View:

Compact

Detailed

Permalink CVE-2026-1609

8.1 HIGH

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): Low (L)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): Low (L)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): High (H)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): High (H)
Modified Availability (MA): None (N)

created 2 weeks, 1 day ago Activity log

Created suggestion 2 weeks, 1 day ago

Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.

References

https://access.redhat.com/security/cve/CVE-2026-1609 x_refsource_REDHATvdb-entry
RHBZ#2435257 issue-trackingx_refsource_REDHAT
https://github.com/keycloak/keycloak/issues/46144
https://github.com/keycloak/keycloak/releases/tag/26.5.3
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1609.json x_sadp-csaf-vex

Affected products

Keycloak

<26.5.3

keycloak-quarkus-server

keycloak-quarkus-server-app

keycloak-quarkus-server-deployment

Matching in nixpkgs

pkgs.keycloak

Identity and access management for modern applications and services

nixos-unstable 26.6.3
- nixpkgs-unstable 26.6.3
- nixos-unstable-small 26.6.3
nixos-26.05 26.6.3
- nixos-26.05-small 26.7.0
- nixpkgs-26.05-darwin 26.6.3

pkgs.keycloak-config-cli

Import YAML/JSON-formatted configuration files into Keycloak

nixos-unstable 6.4.0
- nixpkgs-unstable 6.4.0
- nixos-unstable-small 6.4.0
nixos-26.05 6.4.0
- nixos-26.05-small 6.4.0
- nixpkgs-26.05-darwin 6.4.0

pkgs.terraform-providers.keycloak

None

nixos-unstable 5.8.0
- nixpkgs-unstable 5.8.0
- nixos-unstable-small 5.8.0
nixos-26.05 5.7.0
- nixos-26.05-small 5.7.0
- nixpkgs-26.05-darwin 5.7.0

pkgs.python313Packages.python-keycloak

Provides access to the Keycloak API

nixos-unstable 7.1.1
- nixpkgs-unstable 7.1.1
- nixos-unstable-small 7.1.1
nixos-26.05 7.0.2
- nixos-26.05-small 7.0.2
- nixpkgs-26.05-darwin 7.0.2

pkgs.python314Packages.python-keycloak

Provides access to the Keycloak API

nixos-unstable 7.1.1
- nixpkgs-unstable 7.1.1
- nixos-unstable-small 7.1.1
nixos-26.05 7.0.2
- nixos-26.05-small 7.0.2
- nixpkgs-26.05-darwin 7.0.2

pkgs.terraform-providers.keycloak_keycloak

None

nixos-unstable 5.8.0
- nixpkgs-unstable 5.8.0
- nixos-unstable-small 5.8.0
nixos-26.05 5.7.0
- nixos-26.05-small 5.7.0
- nixpkgs-26.05-darwin 5.7.0

Package maintainers

@kritdass Krit Dass <dasskrit@gmail.com>
@talyz Kim Lindberger <kim.lindberger@gmail.com>
@jefferyoo Jeffery Oo <oojefferywm@proton.me>
@NickCao Nick Cao <nickcao@nichi.co>
@ap-1 Anish Pallati <i@anish.land>
@ngerstle Nicholas Gerstle <ngerstle@gmail.com>
@leona-ya Leona Maroni <nix@leona.is>
@vitorpavani Vitor Pavan <vipavani@hotmail.com>

Permalink CVE-2025-13881

2.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 5 months, 4 weeks ago by @jopejoe1 Activity log

Created suggestion 6 months ago
@jopejoe1 ignored
5 packages
- terraform-providers.keycloak
- python312Packages.python-keycloak
- python313Packages.python-keycloak
- python314Packages.python-keycloak
- terraform-providers.keycloak_keycloak
5 months, 4 weeks ago

Org.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api

A flaw was found in Keycloak Admin API. This vulnerability allows an administrator with limited privileges to retrieve sensitive custom attributes via the /unmanagedAttributes endpoint, bypassing User Profile visibility settings.

References

https://access.redhat.com/security/cve/CVE-2025-13881 x_refsource_REDHATvdb-entry
RHBZ#2418330 issue-trackingx_refsource_REDHAT
RHSA-2026:2365 x_refsource_REDHATvendor-advisory
RHSA-2026:2366 x_refsource_REDHATvendor-advisory

Affected products

keycloak

rhbk/keycloak-rhel9

rhbk/keycloak-rhel9-operator

rhbk/keycloak-operator-bundle

Matching in nixpkgs

pkgs.keycloak

Identity and access management for modern applications and services

nixos-unstable 26.4.5
- nixpkgs-unstable 26.5.2
- nixos-unstable-small 26.5.2

Ignored packages (5)

pkgs.terraform-providers.keycloak

None

pkgs.python312Packages.python-keycloak

None

nixos-unstable 4.0.0

pkgs.python313Packages.python-keycloak

Provides access to the Keycloak API

nixos-unstable 4.0.0
- nixpkgs-unstable 4.0.0
- nixos-unstable-small 4.0.0

pkgs.python314Packages.python-keycloak

Provides access to the Keycloak API

nixos-unstable -
- nixpkgs-unstable 4.0.0
- nixos-unstable-small 4.0.0

pkgs.terraform-providers.keycloak_keycloak

None

nixos-unstable 5.5.0
- nixpkgs-unstable 5.6.0
- nixos-unstable-small 5.6.0

Package maintainers

@leona-ya Leona Maroni <nix@leona.is>
@talyz Kim Lindberger <kim.lindberger@gmail.com>
@jefferyoo Jeffery Oo <oojefferywm@proton.me>
@ngerstle Nicholas Gerstle <ngerstle@gmail.com>
@NickCao Nick Cao <nickcao@nichi.co>
@kritdass Krit Dass <dasskrit@gmail.com>
@ap-1 Anish Pallati <i@anish.land>

Permalink CVE-2025-5416

2.7 LOW

CVSS version (CVSS): 3.1
Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H)
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): Low (L)
Integrity (I): None (N)
Availability (A): None (N)
Modified Attack Vector (MAV): Network (N)
Modified Attack Complexity (MAC): Low (L)
Modified Privileges Required (MPR): High (H)
Modified User Interaction (MUI): None (N)
Modified Confidentiality (MC): Low (L)
Modified Scope (MS): Unchanged (U)
Modified Integrity (MI): None (N)
Modified Availability (MA): None (N)

updated 9 months ago by @LeSuisse Activity log

Created suggestion 10 months, 2 weeks ago
@LeSuisse ignored
3 packages
- terraform-providers.keycloak
- python312Packages.python-keycloak
- python313Packages.python-keycloak
9 months ago

Keycloak-core: keycloak environment information

A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information.