# Redhat Keycloak


- [CVE-2022-4361](https://insights.sbomify.com/CVE-2022-4361/): Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC (critical 10.0)
- [CVE-2022-1245](https://insights.sbomify.com/CVE-2022-1245/): Keycloak vulnerable to privilege escalation on Token Exchange feature (critical 9.8)
- [CVE-2021-20195](https://insights.sbomify.com/CVE-2021-20195/): keycloak Self Stored Cross-site Scripting vulnerability (critical 9.6)
- [CVE-2019-14910](https://insights.sbomify.com/CVE-2019-14910/): Keycloak Authentication Error (critical 9.3)
- [CVE-2019-14909](https://insights.sbomify.com/CVE-2019-14909/): Keycloak Authentication Error (critical 9.3)
- [CVE-2022-3782](https://insights.sbomify.com/CVE-2022-3782/): Keycloak vulnerable to path traversal via double URL encoding (critical 9.1)
- [CVE-2019-14837](https://insights.sbomify.com/CVE-2019-14837/): keycloak vulnerable to unauthorized login via mail server setup (critical 9.1)
- [CVE-2026-3047](https://insights.sbomify.com/CVE-2026-3047/): Keycloak SAML Broken has Authentication Bypass by Primary Weakness (high 8.8)
- [CVE-2023-4918](https://insights.sbomify.com/CVE-2023-4918/): Plaintext storage of user password (high 8.8)
- [CVE-2021-4133](https://insights.sbomify.com/CVE-2021-4133/): Improper Authorization in Keycloak (high 8.8)
- [CVE-2024-1132](https://insights.sbomify.com/CVE-2024-1132/): Keycloak: path transversal in redirection validation (high 8.1)
- [CVE-2022-4137](https://insights.sbomify.com/CVE-2022-4137/): Keycloak: reflected xss attack (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/products/redhat/keycloak/