Is org.keycloak:keycloak-parent safe ? org.keycloak:keycloak-parent (maven) has 26 known vulnerabilities, the worst rated CRITICAL. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 0 direct dependencies
none carry a known advisory
0 packages depend on it
dependents not yet indexed for this ecosystem
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so maven packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 94th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-g8q8-fggx-9r3q, the advisory selected below
// 26 advisories GHSA-g8q8-fggx-9r3q Keycloak does not properly validate URLs included in a redirect. CRIT GHSA-jf86-9434-f8c2 A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server… CRIT GHSA-9hhc-pj4w-w5rv A reflected cross-site scripting (XSS) vulnerability was found in the oob OAuth endpoint due to incorrect null-byte handling. HIGH GHSA-wf7g-7h6h-678v An issue was discovered in Keycloak allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOADSCRIPTS feature is disabled HIGH GHSA-xv7h-95r7-595j A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. HIGH GHSA-fv4q-wm8c-wjg4 A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be… HIGH GHSA-qc72-gfvw-76h7 It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting… HIGH GHSA-85v8-vx4w-q684 A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. HIGH GHSA-7fmw-85qm-h22p It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. HIGH GHSA-cm29-6wx7-p874 A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type… HIGH Show all 26 advisories Keycloak does not properly validate URLs included in a redirect.
Full advisory text at GitHub advisory or NVD .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None // questions Is org.keycloak:keycloak-parent safe to install? CyberXYZ does not call a package safe in absolute terms. It records 26 known vulnerabilities for org.keycloak:keycloak-parent (maven), the worst rated CRITICAL, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does org.keycloak:keycloak-parent have known vulnerabilities? Yes. CyberXYZ records 26 known vulnerabilities for org.keycloak:keycloak-parent (maven), the worst rated CRITICAL. These include GHSA-g8q8-fggx-9r3q, GHSA-jf86-9434-f8c2, GHSA-9hhc-pj4w-w5rv, GHSA-wf7g-7h6h-678v, GHSA-xv7h-95r7-595j.
How do I check org.keycloak:keycloak-parent before installing? Search org.keycloak:keycloak-parent in CyberXYZ Check at https://cyberxyz.io/check?q=org.keycloak%3Akeycloak-parent . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 10:37 UTC. The most recent advisory here was published 2026-02-02. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page