4672 matches found
Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
This vulnerability is caused by the improper mapping of users to organizations based solely on email/username patterns. The issue is limited to the token claim level, meaning the user is not truly added to the organization but may appear as such in applications relying on these claims. The risk...
GHSA-2P82-5WWR-43CW Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
The issue arises because Keycloak does not perform an LDAP bind after a password reset, leading to potential authentication bypass for expired or disabled AD accounts. A fix should enforce LDAP validation after password updates to ensure consistency with AD authentication policies...
com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.10 <=1.4.11), com.github.vzakharchenko:cisco-radius-plugin (>=1.4.10 <=1.4.11) +27 more potentially affected by CVE-2025-0604 via org.keycloak:keycloak-ldap-federation (>=1.0-beta-4 <=26.0.1)
org.keycloak:keycloak-ldap-federation MAVEN version =1.0-beta-4, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =2.5.6-24.0, =0.1.0, =0.2, =1.0-beta-4, =26.0.1 and more Source cves: CVE-2025-0604 Source advisory: OSV:GHSA-2P82-5WWR-43CW...
Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
The issue arises because Keycloak does not perform an LDAP bind after a password reset, leading to potential authentication bypass for expired or disabled AD accounts. A fix should enforce LDAP validation after password updates to ensure consistency with AD authentication policies...
Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.10 Images Update
New images are available for Red Hat build of Keycloak 26.0.10 and Red Hat build of Keycloak 26.0.10 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...
keycloak-ldap-federation: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials against AD. This vulnerability allows users whose AD accounts are expired or disabled to regain access in Keycloak, bypassing AD...
keycloak-services: Improper Authorization in Keycloak Organization Mapper Allows Unauthorized Organization Claims
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...
Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.10 Update
New Red Hat build of Keycloak 26.0.10 packages are available from the Customer Portal Red Hat build of Keycloak 26.0.10 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...
The vulnerability of the Proxy Header Handler component of the Keycloak identity and access management software allows a hacker to trigger a service failure.
The vulnerability of the Proxy Header Handler component of the Keycloak identity and access management software is related to shortcomings in HTTP request processing. Exploiting this vulnerability could allow a attacker to cause service failures...
The vulnerability of the SearchQueryUtils function in the software for managing identity and access control in Keycloak allows a hacker to trigger a service denial.
The vulnerability of the SearchQueryUtils function in the Keycloak identity and access management software relates to improper external control of the file name or path. Exploiting this vulnerability could allow a malicious actor to cause service failures...
GHSA-MQ23-VVG7-XFM4 Rancher does not Properly Validate Account Bindings in SAML Authentication Enables User Impersonation on First Login
Impact A vulnerability in Rancher has been discovered, leading to a local user impersonation through SAML Authentication on first login. The issue occurs when a SAML authentication provider AP is configured e.g. Keycloak. A newly created AP user can impersonate any user on Rancher by manipulating...
GHSA-7WRW-R4P8-38RX vulnerabilities
Vulnerabilities for packages: multus-cni, kuberay-operator, mage, git-credential-oauth, harbor-registry, oauth2-proxy, ip-masq-agent, vendir, age, promxy, speedtest-go, kubernetes-csi-livenessprobe, swagger, kafka-proxy, controller-gen, extism, hello-world-golang,...
Cross-site Scripting (XSS)
Keycloak is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper input validation due to a privileged attacker being able to inject a malicious payload as the permission while creating items Resource and Permissions from the admin console...
Improper Access Control
org.keycloak, keycloak-services is vulnerable to Improper Access Control. The vulnerability is due to improper user-organization mapping due to matching usernames or emails with an organization’s domain pattern at the mapper level, allows an attacker to bypass authorization and escalate privilege...
Keycloak 26.x < 26.0.10 / 26.1.x < 26.1.3 / 26.2.0 Improper Authorization
The version of Keycloak installed on the remote host is 26.0 prior to 26.0.10, 26.1 prior to 26.1.3, or prior to 26.2.0. It is, therefore, affected by an Improper Authorization vulnerability. A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an...
GHSA-Q4XQ-445G-G6CH vulnerabilities
Vulnerabilities for packages: keycloak, keycloak-config-cli...
Keycloak allows cross-site scripting (XSS)
A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items Resource and Permissions from the admin console, leading to a stored cross-site scripting XSS attack...
be.jidoka:jdk-keycloak-admin (>=2.0.0 <=2.4.0), ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0) +716 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (>=1.0-alpha-1 <=26.1.2)
org.keycloak:keycloak-core MAVEN version =1.0-alpha-1, =2.0.0, =0.1.0, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.4.3, =1.4.3, =1.6.5 and more Source cves: CVE-2024-4028 Source advisory: OSV:GHSA-Q4XQ-445G-G6CH...
GHSA-Q4XQ-445G-G6CH Keycloak allows cross-site scripting (XSS)
A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use a malicious payload as the permission while creating items Resource and Permissions from the admin console, leading to a stored cross-site scripting XSS attack...
