Keycloak bug bounty programs
keycloak.org Updated
Keycloak runs one public program: a Sorona bug bounty paying up to $1,500.
- Top reward
- $1,500
- Sorona
- Programs
- 1
- 1 pays cash
- Targets in scope
- 8
- 2 types
- Last change
- None yet
- Tracked since Nov 2026
Where to report
The one public program Keycloak runs.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Keycloak
Sorona · Bug bounty |
– | – | – | $100 | $1,500 | Partial | – | 7 days promised | Open |
-
- Critical
- –
- High
- –
- Medium
- –
- Low
- $100
- Safe harbor
- Partial
- First response
- 7 days promised
Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
8 targets. 6 excluded.
-
https://www.keycloak.org
Web
-
Keycloak Server, latest stable release, as a full white-box target with source access provided to researchers. This is the primary asset.
Products and areas
-
OpenID Connect, OAuth 2.0, and SAML flows: login and authentication, token issuance and validation, refresh, scope handling, and SAML assertion processing.
Products and areas
-
Realm, user, and session management surfaces covered by the Server Administration and Securing Applications guides.
Products and areas
-
Standard web and application vulnerability classes demonstrated with a working proof of concept against one of the three in-scope assets.
Products and areas
-
The Admin Console and Account Console, along with their backing server endpoints, subject to the trusted-administrator threat model below.
Products and areas
-
The Keycloak JavaScript adapter (keycloak-js client library).
Products and areas
-
The Keycloak Operator, used to deploy and manage Keycloak on Kubernetes.
Products and areas
No target matches. Try part of a host name, such as the company name.
Out of scope 6
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
Anything that only works with legitimate administrator access. The threat model treats administrators as trusted, so an issue exploitable solely by an admin is not rewarded.
-
Assets outside the three listed targets: other adapters and client libraries, forks, and third-party integrations or extensions.
-
Findings from static scanners or AI tools submitted without a working proof of concept, which Keycloak's security policy rejects outright.
-
Flaws that depend on an outdated release rather than the current stable version.
-
Issues in experimental or unreleased features, which are triaged as ordinary bugs.
-
Reports that lack a minimal, reproducible example.
Recent changes
Reward and scope changes across every Keycloak program, newest first.
No changes recorded yet. New targets and reward moves show up here and in the RSS feed.
Recent CVEs
Published vulnerabilities in Keycloak products, from the NVD.
-
CVE-2017-12161 High
It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks.
-
CVE-2014-3651 High
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.
-
CVE-2017-12158 Medium
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
-
CVE-2017-12159 High
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
-
CVE-2014-3709 High
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
-
CVE-2017-7474 Critical
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.
About this page
This page gathers every public program listed under keycloak.org: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.