products / keycloak
Keycloak
Keycloak is Red Hat's open-source identity and access management platform for SSO, OAuth2/OIDC, and user federation. NVD tracks product CVEs under cpe:2.3:a:redhat:keycloak. Example responses below are illustrative; live risk_state and fields depend on synthesis after ingestion.
api usage
Querying Keycloak
product slug
keycloakversion format
20.0.0, 25.0.0, semverbash
curl "https://api.attestd.io/v1/check?product=keycloak&version=20.0.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Keycloak 20.0.0 overlaps multiple NVD ranges for authentication bypass, redirect validation, and path traversal issues. Expect risk_state at high or elevated after synthesis.
json
{
"product": "keycloak",
"version": "20.0.0",
"supported": true,
"risk_state": "high",
"risk_factors": [
"remote_code_execution",
"patch_available",
"internet_exposed_service"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": "24.0.2",
"confidence": 0.82,
"cve_ids": ["CVE-2023-6787", "CVE-2024-1132"],
"last_updated": "2026-05-13T18:00:00Z",
"supply_chain": null
}safe version
Keycloak 25.0.0 is used as a newer patch level illustrative query; verify against live /v1/check after ingestion.
bash
curl "https://api.attestd.io/v1/check?product=keycloak&version=25.0.0" \
-H "Authorization: Bearer $ATTESTD_KEY"notable cves
CVE history
Keycloak has a solid NVD history for IAM-specific flaws including improper redirect validation and brute-force protection bypasses.
| CVE | Description | CVSS |
|---|---|---|
CVE-2023-6787 | Authentication bypass via improper redirect validation in Keycloak (high-confidence NVD coverage). | 8.1 |
CVE-2024-1132 | Path traversal in redirect URI validation enabling account takeover scenarios. | 8.1 |
related