An analysis of the Keycloak authentication system

That doesn't help you fix other vulnerabilities that may have been found and reported by others but not fixed. You alone will never find all of them.

This is a digital security company reporting their findings, along with the fix. They did everything that could be expected of them. The real problem is how long RH took to address vulnerabilities. OSS isn't an excuse. There are other OSS projects with much less resources, that take security much more seriously. To make it worse, it isn't easy switch IdP software - even for OSS ones.