CVE-2023-6563High· 7.7▾ TwilightAn unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 42.4 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.2%
An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system.
keycloak < 21.0.0single_sign-on = 7.6single_sign-onopenshift_container_platform = 4.11openshift_container_platform = 4.12openshift_container_platform_for_power = 4.9openshift_container_platform_for_power = 4.10openshift_container_platform_for_ibm_linuxone = 4.9openshift_container_platform_for_ibm_linuxone = 4.10Upgrade past the affected range:
keycloak 21.0.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-6291High· 7.1A flaw was found in the redirect_uri validation logic in Keycloak
CVE-2025-2559Medium· 4.9A flaw was found in Keycloak
CVE-2023-6927Medium· 4.6A flaw was found in Keycloak
CVE-2025-3501High· 8.2A flaw was found in Keycloak
CVE-2024-1249High· 7.4A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages
CVE-2023-6717Medium· 6.0A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk