org.keycloak:keycloak-ldap-federation

Maven5 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting org.keycloak:keycloak-ldap-federationpage 1 of 1

CVE-2022-2232HIGHCVSS 7.5EG 7.5fixed in 23.0.1
2024-11-14
vulnerable: 1.0-beta-4 ... 9.0.3 (151 versions)
A flaw was found in the Keycloak package. This flaw allows an attacker to utilize an LDAP injection to bypass the username lookup or potentially perform other malicious actions.
CVE-2024-5967LOWCVSS 2.7EG 2.7fixed in 25.0.1, 22.0.12 or 24.0.6, by version range
2024-06-18
vulnerable: 23.0.0 ... 24.0.5 (14 versions)
A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows an attacker with admin access (permis…
CVE-2025-0604MEDIUMCVSS 5.4EG 5.4fixed in 26.1.3 or 26.0.10, by version range
2025-01-22
vulnerable: 1.0-beta-4 ... 9.0.3 (180 versions)
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expi…
CVE-2025-13467MEDIUMCVSS 5.5EG 5.5fixed in 26.4.6 or 26.2.11, by version range
2025-11-25
vulnerable: 1.0-beta-4 ... 9.0.3 (192 versions)
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
CVE-2026-9801MEDIUMCVSS 4.9EG 4.9fixed in 26.6.3
2026-05-28
vulnerable: 1.0-beta-4 ... 9.0.3 (217 versions)
A flaw was found in Keycloak. A remote attacker with high privileges, such as a realm administrator configuring a malicious Lightweight Directory Access Protocol (LDAP) server or an attacker compromising an upstream LDAP server, could expl…

Check whether org.keycloak:keycloak-ldap-federation is used in your infrastructure

EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.keycloak:keycloak-ldap-federation CVEs against the assets you own.

Book a Demo →