Keycloak
Keycloak is Red Hat's open-source identity and access management platform for SSO, OAuth2/OIDC, and user federation. Deployments sit on the Internet-facing auth path for apps and APIs, so privilege escalation and session flaws are high impact. NVD tracks product CVEs under cpe:2.3:a:redhat:keycloak.
Querying Keycloak
keycloak20.0.0, 26.4.4curl "https://api.attestd.io/v1/check?product=keycloak&version=20.0.0" \
-H "Authorization: Bearer $ATTESTD_KEY"Keycloak 20.0.0 overlaps NVD ranges for session hijack (CVE-2023-6787) and redirect URL validation bypass (CVE-2024-1132). Aggregated risk for this version is high.
{
"product": "keycloak",
"version": "20.0.0",
"supported": true,
"risk_state": "high",
"risk_factors": [
"remote_code_execution",
"no_authentication_required",
"internet_exposed_service",
"patch_available"
],
"actively_exploited": false,
"remote_exploitable": true,
"authentication_required": false,
"patch_available": true,
"fixed_version": "26.4.4",
"confidence": 0.5,
"cve_ids": [
"CVE-2022-1274",
"CVE-2022-3782",
"CVE-2022-3916",
"CVE-2022-4361",
"CVE-2023-6134",
"CVE-2023-6291",
"CVE-2023-6563",
"CVE-2023-6717",
"CVE-2023-6787",
"CVE-2024-10270",
"CVE-2024-10492",
"CVE-2024-11734",
"CVE-2024-11736",
"CVE-2024-4629",
"CVE-2024-7260",
"CVE-2024-7341",
"CVE-2024-8698",
"CVE-2024-9666",
"CVE-2025-0604",
"CVE-2025-10939",
"CVE-2025-12390",
"CVE-2026-0871"
],
"cves": null,
"max_epss": 0.05796,
"last_updated": "2026-08-05T03:21:20.799516Z",
"supply_chain": null,
"supply_chain_monitored": false,
"typosquat": null
}Keycloak 26.4.4 is past the fixed lines for CVE-2023-6787 and CVE-2024-1132 (both resolved in the 22.0.10 and 24.0.3 branch cuts).
curl "https://api.attestd.io/v1/check?product=keycloak&version=26.4.4" \
-H "Authorization: Bearer $ATTESTD_KEY"CVE history
Keycloak CVEs concentrate on authorization gaps in token exchange, session handling, and redirect validation. Deserialization issues appear on older major lines. Multi-branch fixes are common because Red Hat ships concurrent supported streams.
| CVE | Description | Affects | CVSS |
|---|---|---|---|
CVE-2022-1245 | Missing authz on token exchange lets a client escalate privileges with a valid access token. | <18.0.0 | 9.8 |
CVE-2023-6787 | Re-auth flaw hijacks an active Keycloak session via a new authentication process. | <22.0.10 / ≥23.0.0 <24.0.3 | 8.8 |
CVE-2024-1132 | Redirect URL validation bypass reaches other URLs / sensitive endpoints. | ≥21.1.0 <22.0.10 / ≥23.0.0 <24.0.3 | 8.1 |
CVE-2020-1714 | Unsafe ObjectInputStream use allows deserialization of attacker data. | <11.0.0 | 8.8 |
KEV = CISA Known Exploited Vulnerabilities catalog. Active exploitation confirmed.
redhat:keycloak CPE
NVD files Keycloak product CVEs under the Red Hat vendor namespace with semver-style CPE version ranges across concurrent majors.
cpe:2.3:a:redhat:keycloakSSO, OIDC, and federation CVEsAttestd maps the keycloak slug to this namespace and merges multi-branch NVD ranges into one check response.