ZoomEye finds 40,059 Keycloak servers exposed online

ZoomEye's scan found 40,059 services presenting a Keycloak fingerprint in a query run on September 27, 2026. The administrative console is reachable wherever the server is reachable, making the identity provider a trust anchor for every connected application.

• Query app="Keycloak" returned 40,059 matching services
• Admin console is reachable wherever the server is reachable
• Top risks: weak admin credentials, self-registration, dev defaults
• A configuration review takes about 15 minutes