@keycloak/keycloak-admin-client
A client to interact with Keycloak's Administration API
Security Advisories for @keycloak/keycloak-admin-client in npm
Low
5 months ago
Keycloak vulnerable to authorization bypass via the Admin API
maven, npm
org.keycloak:keycloak-js-admin-client, @keycloak/keycloak-admin-client
Potential
High
10 months ago
Keycloak TLS Client-Initiated Renegotiation Denial of Service
maven
org.keycloak:keycloak-quarkus-dist
Potential
Moderate
10 months ago
Keycloak error_description injection on error pages that can trigger phishing attacks
maven
org.keycloak:keycloak-admin-ui, org.keycloak:keycloak-account-ui
Potential
Moderate
11 months ago
Keycloak Potential Variable Reference in Model Storage Services
maven
org.keycloak:keycloak-model-storage-services
Potential
Potential
Moderate
over 1 year ago
Keycloak vulnerable to two factor authentication bypass
maven
org.keycloak:keycloak-services
Potential
Moderate
over 1 year ago
Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
maven
org.keycloak:keycloak-services
Potential
Moderate
over 1 year ago
Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
maven
org.keycloak:keycloak-ldap-federation
Potential
Moderate
over 1 year ago
Keycloak on Quarkus CLI option for encrypted JGroups ignored
maven
org.keycloak:keycloak-quarkus-server
Potential
Moderate
over 1 year ago
Denial of Service in Keycloak Server via Security Headers
maven
org.keycloak:keycloak-quarkus-server
Potential
Moderate
over 1 year ago
Keycloak allows unrestricted admin use of system and environment variables
maven
org.keycloak:keycloak-quarkus-server
Potential
High
over 1 year ago
Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
maven
org.keycloak:keycloak-core
Potential
Moderate
over 1 year ago
Keycloak proxy header handling Denial-of-Service (DoS) vulnerability
maven
org.keycloak:keycloak-quarkus-server
Potential
High
over 1 year ago
Keycloak Build Process Exposes Sensitive Data
maven
org.keycloak:keycloak-quarkus-server
Potential
Moderate
over 1 year ago
Keycloak Path Traversal Vulnerability Due to External Control of File Name or Path
maven
org.keycloak:keycloak-quarkus-server
Potential
Moderate
almost 2 years ago
Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity
maven
org.keycloak:keycloak-core
Potential
High
almost 2 years ago
Keycloak has session fixation in Elytron SAML adapters
maven
org.keycloak:keycloak-services
Potential
Moderate
almost 2 years ago
Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect
maven
org.keycloak:keycloak-services
Potential
High
almost 2 years ago
Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak
maven
org.keycloak:keycloak-saml-core
Potential
Moderate
almost 2 years ago
Keycloak Services has a potential bypass of brute force protection
maven
org.keycloak:keycloak-services
Potential
Potential
Low
about 2 years ago
Keycloak's improper input validation allows using email as username
maven
org.keycloak:keycloak-services
Potential
High
about 2 years ago
Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)
maven
org.keycloak:keycloak-services
Potential
Low
over 2 years ago
Keycloak vulnerable to impersonation via logout token exchange
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak vulnerable to log Injection during WebAuthn authentication or registration
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
Keycloak secondary factor bypass in step-up authentication
maven
org.keycloak:keycloak-services
Potential
High
over 2 years ago
Keycloak path traversal vulnerability in the redirect validation
maven
org.keycloak:keycloak-services
Potential
Moderate
over 2 years ago
keycloak-core: open redirect via "form_post.jwt" JARM response mode
maven
org.keycloak:keycloak-core
Potential
High
over 2 years ago
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted
maven
org.keycloak:keycloak-services
Potential
High
over 2 years ago
Allocation of Resources Without Limits in Keycloak
maven
org.keycloak:keycloak-model-jpa
Potential
High
almost 3 years ago
Keycloak vulnerable to Plaintext Storage of User Password
maven
org.keycloak:keycloak-core
Potential
Moderate
about 3 years ago
Keycloak: Impersonation and lockout possible through incorrect handling of email trust
maven
org.keycloak:keycloak-core
Potential
Moderate
about 3 years ago
Keycloak Untrusted Certificate Validation vulnerability
maven
org.keycloak:keycloak-core
Potential
Low
about 3 years ago
Client Spoofing within the Keycloak Device Authorisation Grant
maven
org.keycloak:keycloak-server-spi-private, org.keycloak:keycloak-services
Potential
High
over 3 years ago
Keycloak vulnerable to user impersonation via stolen UUID code
maven
org.keycloak:keycloak-services
Potential
Moderate
over 3 years ago
HTML Injection in Keycloak Admin REST API
maven
org.keycloak:keycloak-services
Potential
High
over 3 years ago
Keycloak Cross-site Scripting on OpenID connect login service
maven
org.keycloak:keycloak-parent
Potential
Moderate
over 3 years ago
Keycloak has lack of validation of access token on client registrations endpoint
maven
org.keycloak:keycloak-core
Potential
Critical
over 3 years ago
Keycloak vulnerable to path traversal via double URL encoding
maven
org.keycloak:keycloak-parent
Potential
Moderate
over 3 years ago
Keycloak vulnerable to session takeover with OIDC offline refreshtokens
maven
org.keycloak:keycloak-parent
Potential
Moderate
over 3 years ago
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
maven
org.keycloak:keycloak-core
Potential
Moderate
almost 4 years ago
Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles
maven
org.keycloak:keycloak-parent
Potential
High
almost 4 years ago
Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console
maven
org.keycloak:keycloak-parent
Potential
Moderate
almost 4 years ago
Keycloak has Files or Directories Accessible to External Parties
maven
org.keycloak:keycloak-core
Potential
High
almost 4 years ago
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow
maven
org.keycloak:keycloak-core
Potential
Moderate
almost 4 years ago
Keycloak XSS via use of malicious payload as group name when creating new group from admin console
maven
org.keycloak:keycloak-core
Potential
Moderate
almost 4 years ago
Keycloak vulnerable to Improper Certificate Validation
maven
org.keycloak:keycloak-core
Potential
High
almost 4 years ago
Incorrect implementation of lockout feature in Keycloak
maven
org.keycloak:keycloak-parent
Potential
Moderate
about 4 years ago
Keycloak discloses information without authentication
maven
org.keycloak:keycloak-core
Potential
Moderate
about 4 years ago
Keycloak leaks sensitive information in logged exceptions
maven
org.keycloak:keycloak-core
Potential
Moderate
about 4 years ago
Keycloak users may be able to remove MFA from other users' devices
maven
org.keycloak:keycloak-core
Potential
Critical
about 4 years ago
keycloak vulnerable to unauthorized login via mail server setup
maven
org.keycloak:keycloak-core
Potential
High
about 4 years ago
Keycloak Unauthenticated Access
maven
org.keycloak:keycloak-model-jpa, org.keycloak:keycloak-model-infinispan
Potential
Moderate
over 4 years ago
JBoss KeyCloak Cross-site Scripting Vulnerability
maven
org.keycloak:keycloak-core
Potential
Moderate
over 4 years ago
Keycloak Authentication Error
maven
org.keycloak:keycloak-services, org.keycloak:keycloak-saml-adapter-core
Potential
Moderate
over 4 years ago
Reflected XSS on clients-registrations endpoint
maven
org.keycloak:keycloak-parent
Potential
High
over 4 years ago
ECP SAML binding bypasses authentication flows
maven
org.keycloak:keycloak-saml-core
Potential
Potential
Potential
Moderate
over 4 years ago
Cross-site Scripting in keycloak
maven
org.keycloak:keycloak-services, org.keycloak:keycloak-server-spi-private
Potential
High
over 4 years ago
Allocation of Resources Without Limits or Throttling in Keycloak
maven
org.keycloak:keycloak-parent
Potential
High
over 4 years ago
Improper Input Validation in Keycloak
maven
org.keycloak:keycloak-common, org.keycloak:keycloak-core
Potential
Critical
about 5 years ago
keycloak Self Stored Cross-site Scripting vulnerability
maven
org.keycloak:keycloak-core
Potential