@keycloak/keycloak-admin-client
A client to interact with Keycloak's Administration API
Security Advisories for @keycloak/keycloak-admin-client in npm
Low
5 months ago
Keycloak vulnerable to authorization bypass via the Admin API
maven, npm
org.keycloak:keycloak-js-admin-client, @keycloak/keycloak-admin-client
Potential
Moderate
9 months ago
Keycloak does not invalidate offline sessions when the offline_access scope is removed
maven
org.keycloak:keycloak-services
Potential
Moderate
about 1 year ago
Keycloak Privilege Escalation Vulnerability in Admin Console (FGAPv2 Enabled)
maven
org.keycloak:keycloak-services
Potential
Moderate
over 1 year ago
Keycloak on Quarkus CLI option for encrypted JGroups ignored
maven
org.keycloak:keycloak-quarkus-server
Potential
High
over 1 year ago
Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
maven
org.keycloak:keycloak-core
Potential
High
over 1 year ago
Keycloak Build Process Exposes Sensitive Data
maven
org.keycloak:keycloak-quarkus-server
Potential
Moderate
almost 2 years ago
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect
maven
org.keycloak:keycloak-services
Potential
Low
about 2 years ago
Keycloak Denial of Service via account lockout
maven
org.keycloak:keycloak-services
Potential
Low
about 2 years ago
Keycloak's improper input validation allows using email as username
maven
org.keycloak:keycloak-services
Potential
High
about 2 years ago
Keycloak's admin API allows low privilege users to use administrative functions
maven
org.keycloak:keycloak-services
Potential
Low
over 2 years ago
Keycloak vulnerable to impersonation via logout token exchange
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak vulnerable to session hijacking via re-authentication
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow
maven
org.keycloak:keycloak-services
Potential
High
over 2 years ago
Allocation of Resources Without Limits in Keycloak
maven
org.keycloak:keycloak-model-jpa
Potential
Low
over 2 years ago
Keycloak vulnerable to LDAP Injection on UsernameForm Login
maven
org.keycloak:keycloak-services, org.keycloak:keycloak-ldap-federation
Potential
High
almost 3 years ago
Keycloak vulnerable to Plaintext Storage of User Password
maven
org.keycloak:keycloak-core
Potential
High
about 3 years ago
Keycloak vulnerable to Improper Client Certificate Validation for OAuth/OpenID clients
maven
org.keycloak:keycloak-services
Potential
Moderate
about 3 years ago
Keycloak Untrusted Certificate Validation vulnerability
maven
org.keycloak:keycloak-core
Potential
Low
about 3 years ago
Client Spoofing within the Keycloak Device Authorisation Grant
maven
org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services
Potential
High
over 3 years ago
Keycloak vulnerable to user impersonation via stolen UUID code
maven
org.keycloak:keycloak-services
Potential
Moderate
over 3 years ago
HTML Injection in Keycloak Admin REST API
maven
org.keycloak:keycloak-services
Potential
Moderate
over 3 years ago
Keycloak vulnerable to Cross-site Scripting
maven
org.keycloak:keycloak-services
Potential
Moderate
over 3 years ago
Keycloak has lack of validation of access token on client registrations endpoint
maven
org.keycloak:keycloak-core
Potential
Critical
over 3 years ago
Keycloak vulnerable to path traversal via double URL encoding
maven
org.keycloak:keycloak-parent
Potential
Moderate
over 3 years ago
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
maven
org.keycloak:keycloak-core
Potential
Moderate
almost 4 years ago
Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles
maven
org.keycloak:keycloak-parent
Potential
Moderate
almost 4 years ago
Keycloak has Files or Directories Accessible to External Parties
maven
org.keycloak:keycloak-core
Potential
High
almost 4 years ago
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow
maven
org.keycloak:keycloak-core
Potential
Moderate
about 4 years ago
Keycloak discloses information without authentication
maven
org.keycloak:keycloak-core
Potential
Critical
about 4 years ago
keycloak vulnerable to unauthorized login via mail server setup
maven
org.keycloak:keycloak-core
Potential
High
about 4 years ago
Keycloak Unauthenticated Access
maven
org.keycloak:keycloak-model-jpa, org.keycloak:keycloak-model-infinispan
Potential
Potential
Moderate
about 4 years ago
JBoss KeyCloak Cross-site Scripting Vulnerability
maven
org.keycloak:keycloak-core
Potential
Moderate
about 4 years ago
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
maven
org.keycloak:keycloak-services
Potential
Moderate
over 4 years ago
Reflected XSS on clients-registrations endpoint
maven
org.keycloak:keycloak-parent
Potential
Low
over 4 years ago
Keycloak is vulnerable to IDN homograph attack
maven
org.keycloak:keycloak-services
Potential
Potential
High
over 4 years ago
Keycloak Gatekeeper vulnerable to bypass on using lower case HTTP headers
go
github.com/keycloak/keycloak-gatekeeper
Potential
Critical
about 5 years ago
keycloak Self Stored Cross-site Scripting vulnerability
maven
org.keycloak:keycloak-core
Potential