Security Advisories for org.keycloak:keycloak-core in maven
Potential
Moderate
about 1 year ago
Keycloak does not invalidate sessions when "Remember Me" is disabled
maven
org.keycloak:keycloak-services
Potential
Moderate
about 1 year ago
Keycloak does not invalidate offline sessions when the offline_access scope is removed
maven
org.keycloak:keycloak-services
Potential
Moderate
about 1 year ago
Keycloak error_description injection on error pages that can trigger phishing attacks
maven
org.keycloak:keycloak-admin-ui, org.keycloak:keycloak-account-ui
Potential
Moderate
about 1 year ago
Keycloak Potential Variable Reference in Model Storage Services
maven
org.keycloak:keycloak-model-storage-services
Potential
Potential
Moderate
over 1 year ago
Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
maven
org.keycloak:keycloak-services
Potential
Moderate
over 1 year ago
Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
maven
org.keycloak:keycloak-ldap-federation
High
almost 2 years ago
Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
maven
org.keycloak:keycloak-core
Potential
High
almost 2 years ago
Keycloak Build Process Exposes Sensitive Data
maven
org.keycloak:keycloak-quarkus-server
Potential
Moderate
almost 2 years ago
Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path
maven
org.keycloak:keycloak-quarkus-server
Potential
High
almost 2 years ago
org.keycloak:keycloak-services has Inefficient Regular Expression Complexity
maven
org.keycloak:keycloak-services
Moderate
about 2 years ago
Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity
maven
org.keycloak:keycloak-core
Potential
High
about 2 years ago
Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
maven
org.keycloak:keycloak-saml-core
Potential
Low
over 2 years ago
Keycloak's improper input validation allows using email as username
maven
org.keycloak:keycloak-services
Potential
Low
over 2 years ago
Keycloak vulnerable to impersonation via logout token exchange
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak vulnerable to session hijacking via re-authentication
maven
org.keycloak:keycloak-services
Potential
High
over 2 years ago
Keycloak path traversal vulnerability in redirection validation
maven
org.keycloak:keycloak-services
Potential
High
over 2 years ago
Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak vulnerable to log Injection during WebAuthn authentication or registration
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak Authorization Bypass vulnerability
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak secondary factor bypass in step-up authentication
maven
org.keycloak:keycloak-services
Potential
High
over 2 years ago
Keycloak path traversal vulnerability in the redirect validation
maven
org.keycloak:keycloak-services
Moderate
almost 3 years ago
keycloak-core: open redirect via "form_post.jwt" JARM response mode
maven
org.keycloak:keycloak-core
Potential
High
almost 3 years ago
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
maven
org.keycloak:keycloak-services
Potential
Moderate
almost 3 years ago
Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
maven
org.keycloak:keycloak-services
Potential
Low
almost 3 years ago
Keycloak vulnerable to LDAP Injection on UsernameForm Login
maven
org.keycloak:keycloak-services, org.keycloak:keycloak-ldap-federation
High
about 3 years ago
Keycloak vulnerable to Plaintext Storage of User Password
maven
org.keycloak:keycloak-core
Moderate
over 3 years ago
Keycloak: Impersonation and lockout possible through incorrect handling of email trust
maven
org.keycloak:keycloak-core
Potential
High
over 3 years ago
Keycloak vulnerable to Improper Client Certificate Validation for OAuth/OpenID clients
maven
org.keycloak:keycloak-services
Potential
Critical
over 3 years ago
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
maven
org.keycloak:keycloak-services
Moderate
over 3 years ago
Keycloak Untrusted Certificate Validation vulnerability
maven
org.keycloak:keycloak-core
Potential
Low
over 3 years ago
Client Spoofing within the Keycloak Device Authorisation Grant
maven
org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services
Potential
High
over 3 years ago
Keycloak vulnerable to user impersonation via stolen UUID code
maven
org.keycloak:keycloak-services
Potential
Moderate
over 3 years ago
HTML Injection in Keycloak Admin REST API
maven
org.keycloak:keycloak-services
Potential
High
over 3 years ago
Keycloak Cross-site Scripting on OpenID connect login service
maven
org.keycloak:keycloak-parent
Potential
Moderate
over 3 years ago
Keycloak vulnerable to Cross-site Scripting
maven
org.keycloak:keycloak-services
Moderate
almost 4 years ago
Keycloak has lack of validation of access token on client registrations endpoint
maven
org.keycloak:keycloak-core
Potential
Critical
almost 4 years ago
Keycloak vulnerable to path traversal via double URL encoding
maven
org.keycloak:keycloak-parent
Potential
Moderate
almost 4 years ago
Keycloak vulnerable to session takeover with OIDC offline refreshtokens
maven
org.keycloak:keycloak-parent
Moderate
almost 4 years ago
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
maven
org.keycloak:keycloak-core
Potential
Moderate
about 4 years ago
Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles
maven
org.keycloak:keycloak-parent
Potential
High
about 4 years ago
Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console
maven
org.keycloak:keycloak-parent
Moderate
about 4 years ago
Keycloak has Files or Directories Accessible to External Parties
maven
org.keycloak:keycloak-core
High
about 4 years ago
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow
maven
org.keycloak:keycloak-core
Moderate
about 4 years ago
Keycloak XSS via use of malicious payload as group name when creating new group from admin console
maven
org.keycloak:keycloak-core
Moderate
about 4 years ago
Keycloak vulnerable to Improper Certificate Validation
maven
org.keycloak:keycloak-core
Potential
High
about 4 years ago
Incorrect implementation of lockout feature in Keycloak
maven
org.keycloak:keycloak-parent
Moderate
over 4 years ago
Keycloak discloses information without authentication
maven
org.keycloak:keycloak-core
Moderate
over 4 years ago
Keycloak vulnerable to Server-Side Request Forgery
maven
org.keycloak:keycloak-core
Moderate
over 4 years ago
Keycloak leaks sensitive information in logged exceptions
maven
org.keycloak:keycloak-core
Moderate
over 4 years ago
Keycloak users may be able to remove MFA from other users' devices
maven
org.keycloak:keycloak-core
Critical
over 4 years ago
keycloak vulnerable to unauthorized login via mail server setup
maven
org.keycloak:keycloak-core
Potential
High
over 4 years ago
Keycloak Unauthenticated Access
maven
org.keycloak:keycloak-model-jpa, org.keycloak:keycloak-model-infinispan
Potential
Moderate
over 4 years ago
JBoss KeyCloak Cross-site Scripting Vulnerability
maven
org.keycloak:keycloak-core
Potential
Moderate
over 4 years ago
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
maven
org.keycloak:keycloak-services
Potential
Potential
Moderate
over 4 years ago
Keycloak Authentication Error
maven
org.keycloak:keycloak-services, org.keycloak:keycloak-saml-adapter-core
Potential
Moderate
over 4 years ago
Reflected XSS on clients-registrations endpoint
maven
org.keycloak:keycloak-parent
Potential
Low
over 4 years ago
Keycloak is vulnerable to IDN homograph attack
maven
org.keycloak:keycloak-services
Potential
Low
over 4 years ago
OIDC Logout redirect in keycloak
maven
org.keycloak:keycloak-oidc-client-adapter-pom
Potential
High
over 4 years ago
ECP SAML binding bypasses authentication flows
maven
org.keycloak:keycloak-saml-core
Potential
Critical
over 4 years ago
Keycloak vulnerable to privilege escalation on Token Exchange feature
maven
org.keycloak:keycloak-services
Potential
High
over 4 years ago
Temporary Directory Hijacking Vulnerability in Keycloak
maven
org.keycloak:keycloak-core
Potential
Moderate
almost 5 years ago
Cross-site Scripting in keycloak
maven
org.keycloak:keycloak-services, org.keycloak:keycloak-server-spi-private
Potential
High
almost 5 years ago
Allocation of Resources Without Limits or Throttling in Keycloak
maven
org.keycloak:keycloak-parent
High
almost 5 years ago
Improper Input Validation in Keycloak
maven
org.keycloak:keycloak-common, org.keycloak:keycloak-core
Potential
High
about 5 years ago
Privilege Defined With Unsafe Actions in Keycloak
maven
org.keycloak:keycloak-core
Moderate
about 5 years ago
Exposure of Sensitive Information in keycloak
maven
org.keycloak:keycloak-core
Critical
over 5 years ago
keycloak Self Stored Cross-site Scripting vulnerability
maven
org.keycloak:keycloak-core
Potential
Moderate
over 5 years ago
Keycloak Missing authentication for critical function
maven
org.keycloak:keycloak-core
Moderate
over 6 years ago
Improper Restriction of Rendered UI Layers or Frames in Keycloak
maven
org.keycloak:keycloak-core
Moderate
over 6 years ago
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
maven
org.keycloak:keycloak-core
High
about 7 years ago
Improper Input Validation and Cross-Site Request Forgery in Keycloak
maven
org.keycloak:keycloak-core
Moderate
about 7 years ago
Improper Verification of Cryptographic Signature in keycloak
maven
org.keycloak:keycloak-core
Moderate
over 7 years ago
Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak
maven
org.keycloak:keycloak-core
Moderate
over 7 years ago
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak
maven
org.keycloak:keycloak-core
High
about 8 years ago
Keycloak vulnerable to uncontrolled resource consumption
maven
org.keycloak:keycloak-core
Moderate
about 8 years ago
Moderate severity vulnerability that affects org.keycloak:keycloak-core
maven
org.keycloak:keycloak-core
Moderate
about 8 years ago
Moderate severity vulnerability that affects org.keycloak:keycloak-core
maven
org.keycloak:keycloak-core
Moderate
about 8 years ago
keycloak-core discloses system properties
maven
org.keycloak:keycloak-core
High
about 8 years ago
Keycloak vulnerable to infinite loop based Denial of Service
maven
org.keycloak:keycloak-core
High
about 8 years ago
Improper Authentication in org.keycloak:keycloak-core
maven
org.keycloak:keycloak-core
Moderate
about 8 years ago
Moderate severity vulnerability that affects org.keycloak:keycloak-core
maven
org.keycloak:keycloak-core