Skip to content
THREATWIRE

Keycloak

Identity and access management for apps and services

Identity provider with single sign-on, OpenID Connect, OAuth 2.0 and SAML, user federation, MFA and fine-grained authorisation. A CNCF project.

Open sourceApache-2.0
Alternative toOktaAuth0
Visit website View repository Docs
Homepage of Keycloak
Official website (keycloak.org), captured by ThreatWire.

What Keycloak does

Keycloak adds login, single sign-on and user management to applications without each one implementing authentication. It supports OpenID Connect, OAuth 2.0 and SAML 2.0, identity brokering with social and enterprise providers, user federation with LDAP and Active Directory, and multi-factor authentication.

It started at Red Hat, which still sponsors it, and is an incubating project of the Cloud Native Computing Foundation.

Key features

  • OIDC, OAuth 2.0 and SAML 2.0
  • Identity brokering and social login
  • LDAP and Active Directory federation
  • MFA, passkeys and customisable login themes
  • Admin console and admin REST API

Licence

Apache-2.0 · Apache License 2.0 · Open source

Checked by ThreatWire against the repository's licence file on 2026-10-20. GitHub detects: Apache-2.0.

Security of Keycloak itself

184 published advisories for Keycloak in GitHub repository advisories and OSV.dev; the 12 most recent are listed. Keep the tool updated: security tools often run with broad access.

  • GHSA-xpwp-2pcm-8xq3CVE-2026-90997high2026-09-16

    Replay protection bypass leads to unauthorized access via database driver semantics mismatch

  • GHSA-4gv3-mc9p-5wqcCVE-2026-18963critical2026-08-18

    Keycloak: Unauthenticated account takeover via reset-credentials flow bypass

  • GHSA-95cx-vmr5-3cmrCVE-2026-16102high2026-08-06

    Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers

  • GHSA-hmr6-pxx9-552pCVE-2026-16071medium2026-08-06

    Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary

  • GHSA-f8m4-v488-rmrmCVE-2026-16443high2026-08-06

    Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation

  • GHSA-fgq2-hxm5-8xg2CVE-2026-16442high2026-08-06

    Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction

  • GHSA-3692-rrj9-24qwCVE-2026-16100medium2026-08-06

    Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text

  • GHSA-95rm-h7g9-rhcfCVE-2026-15572high2026-08-06

    Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation

  • GHSA-2888-g6qc-w4mjCVE-2026-15573high2026-08-06

    Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher

  • GHSA-j97h-3f8r-mrjrCVE-2026-11800high2026-06-26

    Authentication bypass via jwt algorithm confusion

  • GHSA-f5p5-6xmx-p252CVE-2026-9800high2026-06-26

    Authorization bypass via incorrect uri comparison

  • GHSA-w3p3-7cjg-vgfwCVE-2026-9799medium2026-06-26

    Unauthorized access to resources via uma permission ticket bypass

Sources: GitHub repository advisories, OSV.dev · checked 2026-10-20.

Categories and tags

Identity, access and secrets management#sso#oidc#saml#cncf#keycloak

Related tools

  • HashiCorp Vault

    Secrets management and encryption as a service

    Secrets manager that stores and issues credentials, certificates and keys, with dynamic secrets, encryption as a service and detailed audit logs.

    Stars
    36k
    Forks
    4.8k
    Last commit
    today
    BUSL-1.1Source-availableIdentity, access and secrets management

  • Infisical

    Secrets, certificates and access management platform

    Open-core platform to manage application secrets and environment variables across teams and infrastructure, with SDKs, a CLI and secret scanning.

    Stars
    30k
    Forks
    2.4k
    Last commit
    today
    MITOpen sourceIdentity, access and secrets management
    Alternative toHashiCorp Vault

  • OpenBao

    Community fork of Vault under an open-source licence

    Linux Foundation project that forked HashiCorp Vault's last MPL-licensed code to keep an open-source secrets manager with a compatible API.

    Stars
    8.6k
    Forks
    636
    Last commit
    today
    MPL-2.0Open sourceIdentity, access and secrets management
    Alternative toHashiCorp Vault

  • KeePassXC

    Offline, cross-platform password manager

    Community port of KeePass for Windows, macOS and Linux that stores passwords in an encrypted KDBX database file you control.

    Stars
    29k
    Forks
    2k
    Last commit
    1 day ago
    GPL-2.0-only OR GPL-3.0-onlyOpen sourcePasswords and credential auditing
    Alternative to1Password

Related on ThreatWire

Share on X@threatwire_https://www.threatwire.tech/tools/keycloak