Keycloak

www.keycloak.org ↗
C
CAUTION
137
Total CVEs
9
Crit / High
31
Medium
82%
Unpatched
15%
Patched
5.9
Avg CVSS
0
CISA KEV
// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB How we collect data →
// INTEL UPGRADE
Full Company Dossier — Coming Soon
Executive profiles, financial exposure, M&A risk, breach history & supply-chain threat mapping — all in one place.
OSINT FINANCIALS EXEC PROFILES BREACH DB
▸ CVE Trend by Year
▸ Patch Coverage
Patched
15%
Unpatched
82%
Pending
3%
✓ 5 patched ✗ 27 unpatched ⏳ 1 pending score
▸ Intelligence by Audience
PoC Available
1 / 20 shown
CISA KEV (Exploited)
0
Shodan Dorks
ssl:"keycloak" port:443
org:"Keycloak" http.status:200
Top EPSS (Exploitation Probability)
CVE-2026-107889 0.27% exploitation probability
CVE-2026-109082 0.25% exploitation probability
CVE-2026-96448 0.24% exploitation probability
CVE-2026-97177 0.24% exploitation probability
CVE-2026-94213 0.23% exploitation probability
Quick Facts for Reporting
Total CVEs tracked
137
Critical severity
0
Actively exploited (CISA)
0
Unpatched ratio
82%
Avg CVSS score
5.9
Security grade
C (CAUTION)
NVD Data Attribution
Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-08-03
Security Risk Score (for investors)
MED
Vuln Volume
POOR
Patch Responsiveness
LOW
CISA Exposure
⚠ Not financial advice. Past security incidents do not guarantee future stock performance.
▸ Security News Google News
Critical Keycloak Password Reset Flaw Could Let Unauthenticated Attackers Take Over Any Account - The Hacker News
The Hacker News 2026-08-24
Keycloak Vulnerability Exposes User Names and Email Addresses Across Admin Boundaries - CyberSecurityNews
CyberSecurityNews 2026-07-31
Critical Keycloak flaw lets attackers hijack any account by bypassing the password reset - Pasquale Pillitteri
Pasquale Pillitteri 2026-08-25
Keycloak Flaw Exposes Users’ Personal Data to Restricted Admins - GBHackers News
GBHackers News 2026-07-31
Critical Red Hat Keycloak Flaw Lets Unauthenticated Attackers Take Over Any User Account - CyberSecurityNews
CyberSecurityNews 2026-08-25
Warning: Critical Account Takeover via Password-reset Flow in Red Hat build of Keycloack, Patch Immediately! - CCB Belgium
CCB Belgium 2026-08-20
▸ Recent CVEs showing 20 of 33
CVE IDSeverityPatchEPSSDate
CVE-2026-109082 6.8 MEDIUM UNKNOWN / UNPATCHED 0.25% 2026-10-12
CVE-2026-107889 PoC 5.5 MEDIUM UNKNOWN / UNPATCHED 0.27% 2026-10-09
CVE-2026-107121 6.5 MEDIUM UNKNOWN / UNPATCHED 0.08% 2026-10-07
CVE-2026-105305 5.4 MEDIUM UNKNOWN / UNPATCHED 0.19% 2026-10-06
CVE-2026-105301 4.0 MEDIUM UNKNOWN / UNPATCHED 0.12% 2026-10-05
CVE-2026-105302 5.7 MEDIUM UNKNOWN / UNPATCHED 0.20% 2026-10-05
CVE-2026-105306 6.5 MEDIUM UNKNOWN / UNPATCHED 0.22% 2026-10-05
CVE-2026-96448 6.6 MEDIUM UNKNOWN / UNPATCHED 0.24% 2026-09-25
CVE-2026-97846 6.8 MEDIUM UNKNOWN / UNPATCHED 0.14% 2026-09-25
CVE-2026-97177 6.6 MEDIUM UNKNOWN / UNPATCHED 0.24% 2026-09-24
CVE-2026-97311 4.3 MEDIUM UNKNOWN / UNPATCHED — 2026-09-24
CVE-2026-97176 4.2 MEDIUM UNKNOWN / UNPATCHED 0.17% 2026-09-24
CVE-2026-96445 6.8 MEDIUM UNKNOWN / UNPATCHED — 2026-09-23
CVE-2026-96446 4.2 MEDIUM UNKNOWN / UNPATCHED — 2026-09-23
CVE-2026-95503 6.8 MEDIUM UNKNOWN / UNPATCHED 0.13% 2026-09-22
CVE-2026-94217 3.5 LOW UNKNOWN / UNPATCHED 0.14% 2026-09-21
CVE-2026-94215 5.5 MEDIUM UNKNOWN / UNPATCHED 0.18% 2026-09-21
CVE-2026-94213 4.9 MEDIUM UNKNOWN / UNPATCHED 0.23% 2026-09-21
CVE-2026-94218 3.1 LOW UNKNOWN / UNPATCHED 0.20% 2026-09-21
CVE-2026-94000 6.6 MEDIUM UNKNOWN / UNPATCHED — 2026-09-19
View all 33 CVEs for Keycloak →
▸Intel
Trust ScoreC — CAUTION
Max CVSS8.1
Last Updated2026-08-03
▸Top Weaknesses
CWE-287
Improper Authentication
17 occurrences in Keycloak CVEs (12% of total)
CWE-287 ⓘ
17
CWE-200
Sensitive Information Exposure
13 occurrences in Keycloak CVEs (9% of total)
CWE-200 ⓘ
13
CWE-862
Unknown Weakness Type
13 occurrences in Keycloak CVEs (9% of total)
CWE-862 ⓘ
13
CWE-863
Incorrect Authorization
8 occurrences in Keycloak CVEs (6% of total)
CWE-863 ⓘ
8
CWE-601
Open Redirect
5 occurrences in Keycloak CVEs (4% of total)
CWE-601 ⓘ
5
CWE-79
Cross-Site Scripting (XSS)
4 occurrences in Keycloak CVEs (3% of total)
CWE-79 ⓘ
4
CWE-770
Unknown Weakness Type
4 occurrences in Keycloak CVEs (3% of total)
CWE-770 ⓘ
4
CWE-284
Improper Access Control
4 occurrences in Keycloak CVEs (3% of total)
CWE-284 ⓘ
4
▸Company Profile

Keycloak is an open-source identity and access management (IAM) solution developed by Red Hat (a subsidiary of IBM). It provides single sign-on (SSO), social login, and user federation capabilities, making it a critical component for securing modern web applications and microservices. Its widespread adoption in enterprise environments underscores its significance in the cybersecurity landscape, particularly for managing authentication and authorization.

▸Response Metrics
Est. MTTR ⓘ ~348 days (Critical)
Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
CVE Trend ⓘ ↗ +287% worse
CVE count 2026 vs 2025:  23 → 89 CVEs
Patch Speed ⓘ Poor (>65% open)
82% of CVEs still unpatched.  Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%
▸ Financial Risk Estimate
Est. GDPR Low
€539K
Est. GDPR High
€5.4M

Based on 0 critical CVEs, 0 CISA KEV, 90% unpatched. Model: GDPR Art.83 · not legal advice.

▸Actions
⚖ Compare with another vendor
▸Embed Badge
Keycloak C valtersit.com