// TECHNOLOGIES / KEYCLOAK

Keycloak

Keycloak, told apart from its own front door.

Keycloak publishes a great deal on purpose: a realm document containing a public_key, a JWKS, an admin console at a path with admin in it, and theme bundles whose translation strings read like credential assignments. None of that is a flaw, and all of it is where scanners go wrong. NewScan requires two Keycloak-owned signals before reporting, then proves the thing that actually matters: whether the Admin REST API answers an anonymous request with a real management object.

▸ Run the free scan ← All technologies

The dashboard blind-spot

// why an external scan matters

// THE DASHBOARD SHOWS (WHAT YOU CONFIGURED)

The realms, clients, redirect URIs, flows and roles you configured, and the hostname you set — as saved in the admin console.

// IT CAN'T SEE (NEWSCAN DOES)

Whether the Admin REST API is reachable from outside your proxy at all, whether a realm export sitting in the web root is handing out client secrets, and whether the issuer your applications trust can be steered by a request header.

What NewScan records

// proven, then reproduced

Admin REST API readable without authentication

CRITICAL

A verified Keycloak admin endpoint returning a real realm, client or user object anonymously. The Admin API can read and change every identity this server issues — anonymous read access to it compromises every application that trusts it.

Realm/client export exposes a private credential

HIGH

An export structure served publicly with a client secret or private key inside. A client secret lets an attacker impersonate that application and mint tokens as it.

Code issued to an unregistered redirect URI

HIGH

The confirmed Keycloak authorization endpoint redirects a code or token to a canary host.

Issuer follows a client-supplied hostname

MEDIUM

Recorded as an observation, not a finding: this is the documented default of start-dev. Real deployment risk — poisoned reset links, token-audience confusion — but not on its own proof of an exploitable production instance.

What is never flagged

// the false-positive contract

A scanner earns its place by what it stays quiet about. These are guarantees, each one asserted by a test that fails the build if it regresses — not best-effort tuning.

The public realm document and JWKS

Publishing a public_key is correct behaviour.

The admin console HTML and the /admin redirect

A path containing "admin" is not an exposed admin API.

Theme and i18n bundles

/resources/<realm>/<theme>/<lang> translation strings read like credentials and access-control errors. They are UI text.

Dynamic client registration

Never invoked — creating a client changes your state. An advertised registration endpoint stays an observation.

How it's proved

// training/good/keycloak

This detector was gated on the real product scoring zero first. A benign Keycloak was re-measured at 0 findings across 73 endpoints before any Keycloak-specific check shipped — the precision control came before the coverage.

// FINGERPRINT FIRST

The check is silent unless the product is confirmed by two independent signals. A single, spoofable marker confirms nothing.

// REPRODUCE BEFORE RECORD

Every finding is re-run by our own detector before it is written down. A model's self-assessment is discarded, not merged.

// SEVERITY THAT MAPS

One calibrated severity per finding, translated into PCI DSS, SOC 2, ISO 27001, HITRUST, HIPAA and NIST 800-53 ratings with remediation SLAs.

Run it against your own Keycloak

NewScan is free and self-hosted — bring your own key. Every check on this page runs in the deterministic floor with no model and no provider key at all, so scanning your own Keycloak surface is local to you and depends on no hosted resource.

Get NewScan (FREE) → Talk through your results