org.keycloak:keycloak-services 26.7.3

Direct Vulnerabilities

Known vulnerabilities in the org.keycloak:keycloak-services package. This does not include vulnerabilities belonging to this package’s dependencies.

Fix vulnerabilities automatically

Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

Fix for free

Vulnerability	Vulnerable Version
H Missing Authorization org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the generic identity-provider creation and update paths in `IdentityProvidersResource` and `IdentityProviderResource`. An attacker can link or update an identity provider for an organization by sending an `organizationId` and organization-specific config in the administrative API request. This lets an administrator with only identity-provider management permission influence which organizations use that provider, affecting how users authenticate into those organizations and allowing unauthorized control over organization login routing. How to fix Missing Authorization? A fix was pushed into the `master` branch but not yet published.	[0,)
H Replay Attack org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Replay Attack through IdP-initiated broker logins in the `services/src/main/java/org/keycloak/broker/saml` component. An attacker can hijack a user session and gain unauthorized access by resending a captured, valid SAML assertion that contains a `OneTimeUse` condition. When Keycloak accepts the assertion without tracking whether that assertion ID was already used, the same unused response can be replayed multiple times against the broker flow. This affects deployments using Keycloak as a SAML identity broker with IdP-initiated login enabled. How to fix Replay Attack? A fix was pushed into the `master` branch but not yet published.	[0,)
M Access Control Bypass org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Access Control Bypass through the Client-Initiated Backchannel Authentication token redemption handler in the `keycloak-services` component. An attacker can obtain access and refresh tokens for a locked user account by redeeming a previously started CIBA authentication request after the account has been locked, provided the request was approved by the user and the attacker has valid client credentials. The vulnerable code path lets token redemption proceed even when brute-force protection has already locked the account. This leaves users exposed to unauthorized token issuance for accounts that were expected to be blocked, undermining the lockout’s protection against continued authentication attempts. How to fix Access Control Bypass? There is no fixed version for `org.keycloak:keycloak-services`.	[0,)
M Missing Authorization org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Authorization through the OIDC token introspection endpoint in the `keycloak-services` component. An attacker can access sensitive token claims by sending an introspection request for a token issued to a different audience from a confidential client configured to receive signed JWT introspection responses. The endpoint marks the token inactive for that client, but it still returns the token’s full claims inside the signed JWT response. This lets an unauthorized client recover audience-restricted token data that should not be exposed. How to fix Missing Authorization? There is no fixed version for `org.keycloak:keycloak-services`.	[0,)
M Improper Verification of Cryptographic Signature org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the backchannel logout endpoint of the `keycloak-services` component. An attacker can force a user to log out by sending a logout request without a cryptographic signature when an OIDC identity provider is configured to skip signature validation. This lets the attacker disrupt the user’s active session and break access to applications until the user signs in again. How to fix Improper Verification of Cryptographic Signature? There is no fixed version for `org.keycloak:keycloak-services`.	[0,)
H Improper Validation of Consistency within Input org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input in the identity provider update flow for OIDC identity providers. An attacker can capture the existing client secret by sending an update as a delegated administrator that reuses the masked client secret sentinel value while changing security-sensitive settings such as the token URL. The vulnerable code path manages identity provider configuration updates in `keycloak-services`, and it accepts the update without forcing the secret to be revalidated against the changed endpoint. This lets the attacker redirect secret-bearing requests to an endpoint they control and expose the real client secret, breaking the confidentiality of the identity provider credentials. How to fix Improper Validation of Consistency within Input? There is no fixed version for `org.keycloak:keycloak-services`.	[2.4.0.CR1,)
M DNS Rebinding org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to DNS Rebinding in the client host restriction logic. An attacker can bypass wildcard domain restrictions on client registration or updates by controlling the reverse DNS for their connection and presenting a hostname that merely ends with the configured suffix, such as `*.example.com`, even when it is not a real subdomain. This lets an unauthorized party modify clients in realms that rely on host-based allowlists, breaking the intended restriction on who can register or update client settings. How to fix DNS Rebinding? There is no fixed version for `org.keycloak:keycloak-services`.	[12.0.0,)
L Improperly Implemented Security Check for Standard org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard through the `secure-client-uris` client policy executor in the client configuration enforcement path. An attacker can bypass the redirect-URI security restriction by supplying a specially crafted domain name that satisfies the prefix check while pointing to an attacker-controlled host. This can let the attacker intercept authentication codes sent over an unencrypted connection, exposing users to account compromise during login flows. How to fix Improperly Implemented Security Check for Standard? There is no fixed version for `org.keycloak:keycloak-services`.	[26.7.0,)
M Improper Validation of Consistency within Input org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input due to improper validation of the `email_verified` claim in the OIDC authentication. An attacker can cause arbitrary email addresses to be marked as verified by configuring a malicious or compromised upstream identity provider and exploiting the lack of correlation between the `id_token` and the userinfo endpoint responses. Note: This is only exploitable if the OIDC identity provider is configured with `trustEmail` set to true and the userinfo endpoint is enabled. How to fix Improper Validation of Consistency within Input? There is no fixed version for `org.keycloak:keycloak-services`.	[0,)
H Incorrect Privilege Assignment org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the `Identity Provider mapper` process. An attacker can gain unauthorized administrative privileges by creating a hardcoded role mapping that assigns elevated roles to themselves or others, thereby bypassing intended authorization checks. How to fix Incorrect Privilege Assignment? There is no fixed version for `org.keycloak:keycloak-services`.	[0,)

Vulnerability

Vulnerable Version

Missing Authorization

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the generic identity-provider creation and update paths in IdentityProvidersResource and IdentityProviderResource. An attacker can link or update an identity provider for an organization by sending an organizationId and organization-specific config in the administrative API request. This lets an administrator with only identity-provider management permission influence which organizations use that provider, affecting how users authenticate into those organizations and allowing unauthorized control over organization login routing.

How to fix Missing Authorization?

A fix was pushed into the master branch but not yet published.

[0,)

Replay Attack

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Replay Attack through IdP-initiated broker logins in the services/src/main/java/org/keycloak/broker/saml component. An attacker can hijack a user session and gain unauthorized access by resending a captured, valid SAML assertion that contains a OneTimeUse condition. When Keycloak accepts the assertion without tracking whether that assertion ID was already used, the same unused response can be replayed multiple times against the broker flow. This affects deployments using Keycloak as a SAML identity broker with IdP-initiated login enabled.

How to fix Replay Attack?

A fix was pushed into the master branch but not yet published.

[0,)

Access Control Bypass

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Access Control Bypass through the Client-Initiated Backchannel Authentication token redemption handler in the keycloak-services component. An attacker can obtain access and refresh tokens for a locked user account by redeeming a previously started CIBA authentication request after the account has been locked, provided the request was approved by the user and the attacker has valid client credentials. The vulnerable code path lets token redemption proceed even when brute-force protection has already locked the account. This leaves users exposed to unauthorized token issuance for accounts that were expected to be blocked, undermining the lockout’s protection against continued authentication attempts.

How to fix Access Control Bypass?

There is no fixed version for org.keycloak:keycloak-services.

[0,)

Missing Authorization

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Missing Authorization through the OIDC token introspection endpoint in the keycloak-services component. An attacker can access sensitive token claims by sending an introspection request for a token issued to a different audience from a confidential client configured to receive signed JWT introspection responses. The endpoint marks the token inactive for that client, but it still returns the token’s full claims inside the signed JWT response. This lets an unauthorized client recover audience-restricted token data that should not be exposed.

How to fix Missing Authorization?

There is no fixed version for org.keycloak:keycloak-services.

[0,)

Improper Verification of Cryptographic Signature

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the backchannel logout endpoint of the keycloak-services component. An attacker can force a user to log out by sending a logout request without a cryptographic signature when an OIDC identity provider is configured to skip signature validation. This lets the attacker disrupt the user’s active session and break access to applications until the user signs in again.

How to fix Improper Verification of Cryptographic Signature?

There is no fixed version for org.keycloak:keycloak-services.

[0,)

Improper Validation of Consistency within Input

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input in the identity provider update flow for OIDC identity providers. An attacker can capture the existing client secret by sending an update as a delegated administrator that reuses the masked client secret sentinel value while changing security-sensitive settings such as the token URL. The vulnerable code path manages identity provider configuration updates in keycloak-services, and it accepts the update without forcing the secret to be revalidated against the changed endpoint. This lets the attacker redirect secret-bearing requests to an endpoint they control and expose the real client secret, breaking the confidentiality of the identity provider credentials.

How to fix Improper Validation of Consistency within Input?

There is no fixed version for org.keycloak:keycloak-services.

[2.4.0.CR1,)

DNS Rebinding

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to DNS Rebinding in the client host restriction logic. An attacker can bypass wildcard domain restrictions on client registration or updates by controlling the reverse DNS for their connection and presenting a hostname that merely ends with the configured suffix, such as *.example.com, even when it is not a real subdomain. This lets an unauthorized party modify clients in realms that rely on host-based allowlists, breaking the intended restriction on who can register or update client settings.

How to fix DNS Rebinding?

There is no fixed version for org.keycloak:keycloak-services.

[12.0.0,)

Improperly Implemented Security Check for Standard

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improperly Implemented Security Check for Standard through the secure-client-uris client policy executor in the client configuration enforcement path. An attacker can bypass the redirect-URI security restriction by supplying a specially crafted domain name that satisfies the prefix check while pointing to an attacker-controlled host. This can let the attacker intercept authentication codes sent over an unencrypted connection, exposing users to account compromise during login flows.

How to fix Improperly Implemented Security Check for Standard?

There is no fixed version for org.keycloak:keycloak-services.

[26.7.0,)

Improper Validation of Consistency within Input

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input due to improper validation of the email_verified claim in the OIDC authentication. An attacker can cause arbitrary email addresses to be marked as verified by configuring a malicious or compromised upstream identity provider and exploiting the lack of correlation between the id_token and the userinfo endpoint responses.

Note: This is only exploitable if the OIDC identity provider is configured with trustEmail set to true and the userinfo endpoint is enabled.

How to fix Improper Validation of Consistency within Input?

There is no fixed version for org.keycloak:keycloak-services.

[0,)

Incorrect Privilege Assignment

org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services.

Affected versions of this package are vulnerable to Incorrect Privilege Assignment in the Identity Provider mapper process. An attacker can gain unauthorized administrative privileges by creating a hardcoded role mapping that assigns elevated roles to themselves or others, thereby bypassing intended authorization checks.

How to fix Incorrect Privilege Assignment?

There is no fixed version for org.keycloak:keycloak-services.

[0,)

org.keycloak:keycloak-services@26.7.3

latest version

first published

latest version published

licenses detected

package registry

Direct Vulnerabilities

Fix vulnerabilities automatically