4672 matches found
CVE-2025-1391
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...
Keycloak 访问控制错误漏洞
Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an access control error vulnerability that stems from a user-organization domain pattern mismatch in the organization function. An attacker exploiting this vulnerability could be...
GHSA-PHG3-GV66-Q38X vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-PHG3-GV66-Q38X vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2025-1247 vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2025-1247 vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2025-25193 vulnerabilities
Vulnerabilities for packages: wildfly, celeborn, keycloak...
CVE-2025-24970 vulnerabilities
Vulnerabilities for packages: druid, docker-selenium, apache-pulsar, management-api-for-apache-cassandra-5.0, selenium, thingsboard, zookeeper, strimzi-kafka-operator, akhq, wildfly, apache-nifi, apache-activemq-artemis, trino, opensearch, kserve-modelmesh, tez, logstash, wavefront-proxy,...
CVE-2025-25193 vulnerabilities
Vulnerabilities for packages: knative-kafka-broker, keycloak, seata, zookeeper-fips, celeborn, wildfly...
GHSA-389X-839F-4RHX vulnerabilities
Vulnerabilities for packages: knative-kafka-broker, keycloak, seata, zookeeper-fips, celeborn, wildfly...
GHSA-389X-839F-4RHX vulnerabilities
Vulnerabilities for packages: wildfly, celeborn, keycloak...
GHSA-4G8C-WM8X-JFHW vulnerabilities
Vulnerabilities for packages: druid, docker-selenium, apache-pulsar, management-api-for-apache-cassandra-5.0, selenium, thingsboard, zookeeper, strimzi-kafka-operator, akhq, wildfly, apache-nifi, apache-activemq-artemis, trino, opensearch, kserve-modelmesh, tez, logstash, wavefront-proxy,...
de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0 <=4.0.5-25.0), org.keycloak:keycloak-guides (>=25.0.0 <=26.0.5) +6 more potentially affected by CVE-2024-10973 via org.keycloak:keycloak-quarkus-server (>=25.0.0 <=26.0.5)
org.keycloak:keycloak-quarkus-server MAVEN version =25.0.0, =3.0.1-25.0, =25.0.0, =25.0.0, =25.0.0, =26.0.0, =25.0.0, =25.0.0, =26.0.0, =26.0.5 Source cves: CVE-2024-10973 Source advisory: OSV:GHSA-G6QQ-C9F9-2772...
GHSA-G6QQ-C9F9-2772 Keycloak on Quarkus CLI option for encrypted JGroups ignored
The env option KCCACHEEMBEDDEDMTLSENABLED does not work and the jgroups replication configuration is always used in plain. This option worked before in 24 and 22. More info in public issue https://github.com/keycloak/keycloak/issues/34644...
Keycloak on Quarkus CLI option for encrypted JGroups ignored
The env option KCCACHEEMBEDDEDMTLSENABLED does not work and the jgroups replication configuration is always used in plain. This option worked before in 24 and 22. More info in public issue https://github.com/keycloak/keycloak/issues/34644...
CVE-2024-34706
Valtimo is an open source business process and case management platform. When opening a form in Valtimo, the access token JWT of the user is exposed to api.form.io via the the x-jwt-token header. An attacker can retrieve personal information from this token, or use it to execute requests to the...
CVE-2024-53843
@dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Reflected Cross-Site Scripting XSS vulnerability was discovered in the authentication flow of the application. This issue arises due to...
Authentication Bypass
Keycloak is vulnerable to Authentication Bypass. The vulnerability is due to the system updating passwords without performing an LDAP bind to validate the new credentials against Active Directory, allowing users with expired or disabled AD accounts to regain access and bypass AD restrictions...
GHSA-M3HP-8546-5QMR Duplicate Advisory: Authentication Bypass Due to Missing LDAP Bind After Password Reset in Keycloak
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2p82-5wwr-43cw. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. When an Active Directory user resets their password, the system updates it without...