Security Advisories for org.keycloak:keycloak-parent in maven
Low
8 months ago
Keycloak Server-Side Request Forgery (SSRF) vulnerability
maven
org.keycloak:keycloak-parent
Moderate
9 months ago
Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
maven
org.keycloak:keycloak-parent
Potential
High
12 months ago
Keycloak TLS Client-Initiated Renegotiation Denial of Service
maven
org.keycloak:keycloak-quarkus-dist
Potential
Moderate
12 months ago
Keycloak does not invalidate sessions when "Remember Me" is disabled
maven
org.keycloak:keycloak-services
Potential
Moderate
12 months ago
Keycloak does not invalidate offline sessions when the offline_access scope is removed
maven
org.keycloak:keycloak-services
Potential
Moderate
over 1 year ago
Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
maven
org.keycloak:keycloak-services
Potential
Moderate
over 1 year ago
Denial of Service in Keycloak Server via Security Headers
maven
org.keycloak:keycloak-quarkus-server
Potential
Moderate
over 1 year ago
Keycloak allows unrestricted admin use of system and environment variables
maven
org.keycloak:keycloak-quarkus-server
Potential
High
almost 2 years ago
Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
maven
org.keycloak:keycloak-core
Potential
High
almost 2 years ago
Keycloak Build Process Exposes Sensitive Data
maven
org.keycloak:keycloak-quarkus-server
Potential
Moderate
almost 2 years ago
Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path
maven
org.keycloak:keycloak-quarkus-server
Potential
Potential
Low
over 2 years ago
Keycloak Denial of Service via account lockout
maven
org.keycloak:keycloak-services
Potential
High
over 2 years ago
Keycloak's admin API allows low privilege users to use administrative functions
maven
org.keycloak:keycloak-services
Potential
High
over 2 years ago
Keycloak path traversal vulnerability in redirection validation
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak secondary factor bypass in step-up authentication
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
keycloak-core: open redirect via "form_post.jwt" JARM response mode
maven
org.keycloak:keycloak-core
Potential
High
almost 3 years ago
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
maven
org.keycloak:keycloak-services
Potential
Moderate
almost 3 years ago
Keycloak vulnerable to reflected XSS via wildcard in OIDC redirect_uri
maven
org.keycloak:keycloak-services
Potential
High
almost 3 years ago
Allocation of Resources Without Limits in Keycloak
maven
org.keycloak:keycloak-model-jpa
Potential
Moderate
over 3 years ago
Keycloak Untrusted Certificate Validation vulnerability
maven
org.keycloak:keycloak-core
Potential
High
over 3 years ago
Keycloak vulnerable to user impersonation via stolen UUID code
maven
org.keycloak:keycloak-services
High
over 3 years ago
Keycloak Cross-site Scripting on OpenID connect login service
maven
org.keycloak:keycloak-parent
Potential
Moderate
over 3 years ago
Keycloak vulnerable to Cross-site Scripting
maven
org.keycloak:keycloak-services
Critical
almost 4 years ago
Keycloak vulnerable to path traversal via double URL encoding
maven
org.keycloak:keycloak-parent
Moderate
almost 4 years ago
Keycloak vulnerable to session takeover with OIDC offline refreshtokens
maven
org.keycloak:keycloak-parent
Potential
Moderate
almost 4 years ago
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
maven
org.keycloak:keycloak-core
Moderate
about 4 years ago
Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles
maven
org.keycloak:keycloak-parent
High
about 4 years ago
Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console
maven
org.keycloak:keycloak-parent
Potential
Moderate
about 4 years ago
Keycloak vulnerable to Improper Certificate Validation
maven
org.keycloak:keycloak-core
High
about 4 years ago
Incorrect implementation of lockout feature in Keycloak
maven
org.keycloak:keycloak-parent
Potential
Moderate
over 4 years ago
Keycloak discloses information without authentication
maven
org.keycloak:keycloak-core
Potential
Moderate
over 4 years ago
Keycloak leaks sensitive information in logged exceptions
maven
org.keycloak:keycloak-core
Potential
Moderate
over 4 years ago
Keycloak users may be able to remove MFA from other users' devices
maven
org.keycloak:keycloak-core
Potential
Critical
over 4 years ago
keycloak vulnerable to unauthorized login via mail server setup
maven
org.keycloak:keycloak-core
Potential
Potential
Moderate
over 4 years ago
JBoss KeyCloak Cross-site Scripting Vulnerability
maven
org.keycloak:keycloak-core
Potential
Moderate
over 4 years ago
Keycloak vulnerable to cross-site scripting via the state parameter
maven
org.keycloak:keycloak-parent
Moderate
over 4 years ago
Reflected XSS on clients-registrations endpoint
maven
org.keycloak:keycloak-parent
Potential
Low
over 4 years ago
Keycloak is vulnerable to IDN homograph attack
maven
org.keycloak:keycloak-services
Potential
High
over 4 years ago
ECP SAML binding bypasses authentication flows
maven
org.keycloak:keycloak-saml-core
Potential
Critical
over 4 years ago
Keycloak vulnerable to privilege escalation on Token Exchange feature
maven
org.keycloak:keycloak-services
Low
over 4 years ago
Generation of Error Message Containing Sensitive Information in Keycloak
maven
org.keycloak:keycloak-parent
Moderate
over 4 years ago
Incorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak
maven
org.keycloak:keycloak-parent
High
over 4 years ago
Allocation of Resources Without Limits or Throttling in Keycloak
maven
org.keycloak:keycloak-parent
Moderate
over 4 years ago
Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak
maven
org.keycloak:keycloak-parent
Potential
High
over 4 years ago
Improper Input Validation in Keycloak
maven
org.keycloak:keycloak-common, org.keycloak:keycloak-core
Potential