Infrastructure
Keycloak: supported versions and open vulnerabilities today
Keycloak 26.8 is supported; 26.7 reached end of life on Oct 1, 2026; the latest release is 26.8.1. 14 high or critical advisories for Keycloak were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 26.8.1
- GitHub stars
- 37.3k
- Licence
- Apache-2.0
- OpenSSF Scorecard
- 8 / 10
Supported versions
Security advisories
56 advisories published in the last 12 months, 14 of them high or critical. 147 in total since records began. Checked packages: org.keycloak:keycloak-services and org.keycloak:keycloak-core.
Keycloak: Unauthenticated account takeover via reset-credentials flow bypass
Fixed in 26.4.15, 26.6.6 and 26.7.2.
Affects org.keycloak:keycloak-services.
EPSS: top 13%Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
No fixed version listed yet.
Affects org.keycloak:keycloak-services.
EPSS: top 71%Keycloak has privilege escalation via improper scope mapping enforcement
Fixed in 26.6.4.
Affects org.keycloak:keycloak-services.
EPSS: top 60%Keycloak: Session fixation in OIDC login flow that can lead to account takeover
Fixed in 26.6.2.
Affects org.keycloak:keycloak-services.
EPSS: top 35%Keycloak: Access token disclosure and implicit flow bypass via forged client data
Fixed in 26.6.2.
Affects org.keycloak:keycloak-services.
EPSS: top 59%Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak
Fixed in 26.6.2.
Affects org.keycloak:keycloak-services.
EPSS: top 59%Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
Fixed in 26.5.7.
Affects org.keycloak:keycloak-services.
EPSS: top 54%Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
Fixed in 26.5.7.
Affects org.keycloak:keycloak-services.
EPSS: top 60%
All org.keycloak:keycloak-services advisories on OSV.devAll org.keycloak:keycloak-core advisories on OSV.dev
Maintenance and supply chain
OpenSSF Scorecard 8 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 10 issue updates found in the last 90 days.
Weakest checks
- Dangerous CI workflow patterns (Dangerous-Workflow 0/10)
Production checklist
Keycloak production checklist: 5 checks before launch
- Should do: Run in production mode with HTTPS and a real hostname
- Should do: Don’t expose the admin console and admin API to the internet
- Should do: Turn on brute-force detection in each realm
Example stacks with Keycloak
Docs and release notes
Check Keycloak in your own stack
This page checks Keycloak in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.