keycloak

Direct Vulnerabilities

Known vulnerabilities in the keycloak package. This does not include vulnerabilities belonging to this package’s dependencies.

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Vulnerability	Vulnerable Version
H CVE-2023-6841	<26.1.4-r0
L Resource Exhaustion	<26.0.5-r1
M Resource Exhaustion	<26.1.3-r0
H Improper Verification of Cryptographic Signature	<25.0.6-r0
L External Control of File Name or Path	<26.0.6-r0
H HTTP Request Smuggling	<26.0.7-r1
L CVE-2024-10039	<26.0.6-r0
M Information Exposure Through Environmental Variables	<26.0.8-r0
L Improper Input Validation	<26.1.3-r0
M Protection Mechanism Failure	<26.0.8-r0
M Use of Hard-coded Credentials	<26.0.6-r0
M HTTP Request Smuggling	<26.0.6-r0
L GHSA-prj3-ccx8-p6x4	<26.3.2-r2
H Allocation of Resources Without Limits or Throttling	<26.3.2-r2
L GHSA-9342-92gg-6v29	<26.3.2-r1
H Improper Neutralization	<26.3.2-r1
M Improper Authentication	<26.2.5-r2
H Improper Certificate Validation	<26.1.4-r0
H Exposure of Data Element to Wrong Session	<26.1.3-r0
L CVE-2025-24970	<26.1.3-r0
M Open Redirect	<23.0.4-r0
M Inefficient Regular Expression Complexity	<26.0.6-r0
M Open Redirect	<25.0.6-r0
L Incorrect Default Permissions	<25.0.1-r0
L CVE-2024-29857	<25.0.0-r0
L CVE-2024-30172	<25.0.0-r0
L CVE-2024-34447	<25.0.0-r0
L CVE-2024-30171	<25.0.0-r0
L Cross-site Scripting (XSS)	<24.0.3-r0
L CVE-2024-1249	<24.0.3-r0
L Open Redirect	<24.0.3-r0
L Permissive Regular Expression	<24.0.3-r0
L Directory Traversal	<24.0.3-r0
L Improper Check for Dropped Privileges	<24.0.3-r0
L Improper Authentication	<24.0.3-r0
H Improper Authentication	<24.0.3-r0
L CVE-2024-29025	<24.0.2-r1
M Arbitrary Code Injection	<24.0.0-r0
C SQL Injection	<23.0.7-r0
M Information Exposure Through Log Files	<22.0.5-r1