- Top reward
- $1,500
- Top severity paid
- Critical
- Assets in scope
- 8
- Public CVEs
- 250
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays from $1,500
- for critical bugs.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 7 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical | $1,500+ | |
| High | $700+ | |
| Medium | $300+ | |
| Low |
|
$100 $100 / 1 month Claude Max |
- Response
-
Within 7 days
The maintainers acknowledge reports within roughly seven business days and follow coordinated disclosure.
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
8 assets you may test, 6 excluded.
Web 1
- https://www.keycloak.org
Products and areas 7
- Keycloak Server, latest stable release, as a full white-box target with source access provided to researchers. This is the primary asset.
- OpenID Connect, OAuth 2.0, and SAML flows: login and authentication, token issuance and validation, refresh, scope handling, and SAML assertion processing.
- Realm, user, and session management surfaces covered by the Server Administration and Securing Applications guides.
- Standard web and application vulnerability classes demonstrated with a working proof of concept against one of the three in-scope assets.
- The Admin Console and Account Console, along with their backing server endpoints, subject to the trusted-administrator threat model below.
- The Keycloak JavaScript adapter (keycloak-js client library).
- The Keycloak Operator, used to deploy and manage Keycloak on Kubernetes.
Out of scope (6)
- Anything that only works with legitimate administrator access. The threat model treats administrators as trusted, so an issue exploitable solely by an admin is not rewarded.
- Assets outside the three listed targets: other adapters and client libraries, forks, and third-party integrations or extensions.
- Findings from static scanners or AI tools submitted without a working proof of concept, which Keycloak's security policy rejects outright.
- Flaws that depend on an outdated release rather than the current stable version.
- Issues in experimental or unreleased features, which are triaged as ordinary bugs.
- Reports that lack a minimal, reproducible example.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz.
-
Test only against the latest released version and state the affected version
-
Provide a minimal, reproducible example with logs, screenshots, or video evidence
-
File a separate report for each distinct finding
-
Validate AI-assisted discoveries yourself and disclose that assistance
-
Do not access or damage data belonging to other users during testing
Not accepted
-
Anything that only works with legitimate administrator access
-
Findings from static scanners or AI tools submitted without a working proof of concept
-
Reports that lack a minimal, reproducible example
-
Issues in experimental or unreleased features
-
Flaws that depend on an outdated release rather than the current stable version
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2017-12161 | It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks. | High 8.8 | 21 Feb 2018 |
| CVE-2014-3651 | JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation. | High 7.5 | 29 Dec 2017 |
| CVE-2017-12158 | It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server. | Medium 5.4 | 26 Oct 2017 |
| CVE-2017-12159 | It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks. | High 7.5 | 26 Oct 2017 |
| CVE-2014-3709 | The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection. | High 8.8 | 18 Oct 2017 |
| CVE-2017-7474 | It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks. | Critical 9.8 | 12 May 2017 |
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays This project runs no bounty of its own. sorona.xyz pays you directly on qualified, reproduced findings. Severity │ sorona.xyz pays Critical │ $1,500+ High │ $700+ Medium │ $300+ Low │ $100 / 1 month Claude Max Submit a vulnerability CVE history 97 Last 12 months 250 Lifetime Access control 38 % Auth bypass 25 % Parsing/validation 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Keycloak runs no bounty of its own today, so report through sorona.xyz and we pay you directly on qualified, reproduced findings. Keycloak is an open-source identity and access management backbone for countless applications, and as a CNCF project it maintains a formal coordinated-disclosure process for its codebase and components. In scope Keycloak Server, latest stable release, as a full white-box target with source access provided to researchers. This is the primary asset. The Keycloak Operator, used to deploy and manage Keycloak on Kubernetes. The Keycloak JavaScript adapter (keycloak-js client library). OpenID Connect, OAuth 2.0, and SAML flows: login and authentication, token issuance and validation, refresh, scope handling, and SAML assertion processing. The Admin Console and Account Console, along with their backing server endpoints, subject to the trusted-administrator threat model below. Realm, user, and session management surfaces covered by the Server Administration and Securing Applications guides. Standard web and application vulnerability classes demonstrated with a working proof of concept against one of the three in-scope assets. Out of scope Anything that only works with legitimate administrator access. The threat model treats administrators as trusted, so an issue exploitable solely by an admin is not rewarded. Findings from static scanners or AI tools submitted without a working proof of concept, which Keycloak's security policy rejects outright. Reports that lack a minimal, reproducible example. Assets outside the three listed targets: other adapters and client libraries, forks, and third-party integrations or extensions. Issues in experimental or unreleased features, which are triaged as ordinary bugs. Flaws that depend on an outdated release rather than the current stable version. Most-valued findings Authentication bypass or broken authentication in the login, OIDC, OAuth 2.0, or SAML flows. Authorization flaws and privilege escalation that grant rights beyond the assigned role without leaning on legitimate admin access. Token-handling defects: OIDC/OAuth 2.0 issuance, validation, scope, and refresh, plus SAML assertion handling, leading to account takeover. Server-side request forgery and injection classes such as SQL injection reachable from an in-scope surface. Cross-site scripting and CSRF in the consoles or their endpoints. Sensitive data or configuration disclosure across a trust boundary. Program rules Submit through sorona.xyz. This project runs no bounty of its own; we validate, coordinate disclosure with the maintainers, and pay you directly. Test only against the latest released version and state the affected version Provide a minimal, reproducible example with logs, screenshots, or video evidence File a separate report for each distinct finding Validate AI-assisted discoveries yourself and disclose that assistance Do not access or damage data belonging to other users during testing No NDA is required to participate in coordinated disclosure Disclosure The maintainers acknowledge reports within roughly seven business days and follow coordinated disclosure. All parties agree on a reasonable window to resolve the issue before any public disclosure. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability