AI-generated from public sourcesThe starting point for every profile: auto-generated by 0-Doubt from public vendor materials, and not yet confirmed by the vendor or an independent analyst. Nothing here is hidden or overstated — it simply has not been reviewed yet.Where every profile starts, before the vendor or an analyst has reviewed it. A higher label means a more independent source — not a better product.How trust works →Secure coding rating: 0/100How this score is computedA product with no known CVEs starts at a neutral score and climbs the longer it goes without one; a product with known CVEs is penalized by severity instead. This one has 99 known CVEs (vendor-level match — see the CVE list below) and is tracked as ~107 days old in our catalog (a stand-in for real release date, which we don't track). The platform admin controls the formula's weights.
Open-source IAM solution for SSO, MFA, and identity federation
Known CVEs (99)About this listSourced from the public NVD database, matched by vendor name. Shown here at the vendor level — we don't track per-product/version data, so a listed CVE may affect a different product from this vendor, not necessarily this one. “New” means published within the last 30 days. “Actively exploited” means CISA's Known Exploited Vulnerabilities (KEV) catalog confirms real-world exploitation, not just a theoretical severity score. An “EPSS” chip appears at 10% and above: that is FIRST's estimated chance of exploitation in the next 30 days, which measures likelihood rather than impact and so can differ sharply from the severity beside it.
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 sav…
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a prop…
A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Key…
Keycloak is an open-source identity and access management platform that adds single sign-on and authentication to applications and services with minimal effort. It provides centralized user management via an admin console and account console, supports standard protocols such as OpenID Connect, OAuth 2.0, and SAML, and offers user federation and social login capabilities.
Strengths
Open source identity and access management
Single sign-on for applications
Support for standard protocols OpenID Connect, OAuth 2.0, SAML
Centralized admin console for user and application management
User federation with LDAP/Active Directory
News about Keycloak (6)Where this comes fromItems from keycloak's own public feeds — changelog, blog, GitHub releases or status page — that name Keycloak in the headline or summary. News from keycloak that does not name this product is on the vendor's page instead. Each headline links to the original source; nothing here is written by 0-Doubt.
