CVE-2025-49006

Wasp Web Application Specification is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability in the OAuth authentication implementation affecting only Keycloak with a specific config. Wasp currently lowercases OAuth user IDs before...

org.keycloak.protocol.services: Keycloak hostname verification

A flaw was found in Keycloak. By setting a verification policy to 'ALL', the trust store certificate verification is skipped, which is unintended...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.5 Security Update

New Red Hat build of Keycloak 26.2.5 packages are available from the Customer Portal Red Hat build of Keycloak 26.2.5 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security fixes...

CVE-2025-49006

Wasp Web Application Specification is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability in the OAuth authentication implementation affecting only Keycloak with a specific config. Wasp currently lowercases OAuth user IDs before...

CVE-2025-49006 Wasp has case insensitive OAuth ID vulnerability

Wasp Web Application Specification is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability in the OAuth authentication implementation affecting only Keycloak with a specific config. Wasp currently lowercases OAuth user IDs before...

CVE-2025-49006

CVE-2025-49006 concerns Wasp (Web Application Specification), a Rails-like framework used with React/Node/Prisma. Prior to 0.16.6, the OAuth implementation lowercases OAuth user IDs before storing/fetching, which can violate OAuth/OpenID Connect specs and lead to user impersonation, account colli...

CVE-2025-49006 Wasp has case insensitive OAuth ID vulnerability

Wasp Web Application Specification is a Rails-like framework for React, Node.js, and Prisma. Prior to version 0.16.6, Wasp authentication has a vulnerability in the OAuth authentication implementation affecting only Keycloak with a specific config. Wasp currently lowercases OAuth user IDs before...

Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.5 Images Security Update

New images are available for Red Hat build of Keycloak 26.2.5 and Red Hat build of Keycloak 26.2.5 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

PT-2025-24435 · Github +4 · Github +4

Name of the Vulnerable Software and Affected Versions: Wasp versions prior to 0.16.6 Description: The issue concerns the implementation of OAuth authentication in Wasp, specifically affecting Keycloak with a particular configuration. Wasp's behavior of lowercasing OAuth user IDs before storing or...

SUSE CVE-2025-48374

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f, when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout...

Sensitive Information Disclosure

zotregistry.dev/zot is vulnerable to Sensitive Information Disclosure. The vulnerability is due to exposed sensitive data due to the clientsecret being printed to container logs when Keycloak is used as an OIDC provider...

CVE-2025-48374

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f, when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout...

CVE-2024-34529

Nebari through 2024.4.1 prints the temporary Keycloak root password...

CVE-2023-24457

A cross-site request forgery CSRF vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick users into logging in to the attacker's account...

CVE-2023-24456

Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login...

CVE-2023-1477

Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak Authenticator Extension: before 7.10.2, before 8.0.3...

CVE-2022-27225

Gradle Enterprise before 2021.4.3 relies on cleartext data transmission in some situations. It uses Keycloak for identity management services. During the sign-in process, Keycloak sets browser cookies that effectively provide remember-me functionality. For backwards compatibility with older Safar...

CVE-2025-48374

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f, when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout...

CVE-2025-48374

Summary: CVE-2025-48374 affects zot, a container image/artifact registry. When using Keycloak as an OpenID Connect provider, the clientsecret is echoed to container stdout logs during startup in versions prior to 2.1.3 (pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f). The issue stems from logg...

CVE-2025-48374 zot logs secrets

zot is ancontainer image/artifact registry based on the Open Container Initiative Distribution Specification. Prior to version 2.1.3 corresponding to pseudoversion 1.4.4-0.20250522160828-8a99a3ed231f, when using Keycloak as an oidc provider, the clientsecret gets printed into the container stdout...