org.keycloak:keycloak-services
Maven103 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.keycloak:keycloak-servicespage 3 of 3
- CVE-2026-9800HIGHCVSS 8.1EG 8.1fixed in 26.6.42026-06-25
vulnerable: 1.0-alpha-1 ... 9.0.3 (228 versions)
A flaw was found in Keycloak Policy Enforcer. This vulnerability allows any authenticated user to bypass all authorization policies, including role, scope, and User-Managed Access (UMA) permission checks. By including the configured access…
- CVE-2026-9802MEDIUMCVSS 6.8EG 6.8fixed in 26.6.32026-05-28
vulnerable: 26.5.0 ... 26.6.2 (11 versions)
A flaw was found in Keycloak. When revokeRefreshToken=true is enabled and persistent session storage is in use, a server restart can reset internal timing mechanisms. This allows a remote attacker, who has previously captured a user's refr…
- CVE-2026-9803MEDIUMCVSS 5.3EG 5.3fixed in 26.6.32026-05-28
vulnerable: 26.5.0 ... 26.6.2 (11 versions)
A flaw was found in Keycloak's ClientRegistrationAuth component. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with a malformed 'Authorization: Bearer' header to any client reg…
Check whether org.keycloak:keycloak-services is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.keycloak:keycloak-services CVEs against the assets you own.
Book a Demo →