4672 matches found
Unauthorized Access
org.keycloak, keycloak-quarkus-server is vulnerable to Unauthorized Access. The vulnerability is due to improper access controls, allowing a high-privileged user to read sensitive information from a Vault file outside the expected context...
Denial Of Service (DoS)
org.keycloak, keycloak-services is vulnerable to Denial Of Service DoS. The vulnerability is due to untrusted data passed to the SearchQueryUtils method, which allows an attacker to exploit Regex complexity and exhaust system resources...
Sensitive Data Exposure
org.keycloak, keycloak-quarkus-server is vulnerable to Sensitive Data Exposure. The vulnerability is due to the capture of sensitive runtime values, such as passwords, during the build process and their embedding as default values in bytecode, which allows an attacker to access sensitive data...
Keycloak < 24.0.9, 25.0.x < 26.0.6 Multiple Vulnerabilities
Keycloak versions installed prior to 24.0.9, 25.0 prior to 26.0.6 are affected by multiple vulnerabilities as referenced in the advisory. - Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on...
The vulnerability of the Keycloak identity and access management software lies in improper external control of the file name or path, allowing unauthorized users to gain unauthorized access to protected information.
The vulnerability of the Keycloak identity and access management software is related to improper external control of the file name or path, resulting from incorrect validation of regular expressions. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthoriz...
The vulnerability of the management software for Keycloak’s identification and access controls is related to the use of pre-set user accounts. This allows a malicious individual to gain unauthorized access to protected information.
The vulnerability of the Keycloak identity and access management software relates to the use of pre-set user credentials. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to protected information...
The vulnerability of the implementation of the mTLS protocol in the Keycloak software for managing identity and access control allows a perpetrator to circumvent security restrictions and gain unauthorized access to protected information.
The vulnerability of the mTLS protocol implementation in the Keycloak identity and access management software is related to a certificate authentication error. Exploiting this vulnerability could allow an attacker to circumvent security restrictions and gain unauthorized access to protected...
FreeBSD : keycloak -- Multiple security fixes (7d7a28cd-7f5a-450a-852f-c49aaab3fa7e)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 7d7a28cd-7f5a-450a-852f-c49aaab3fa7e advisory. Keycloak reports: This update includes 5 security fixes: Tenable has extracted the preceding...
@dapperduckling/keycloak-connector-cluster-redis (>=0.0.5-alpha.0 <=1.0.30), @dapperduckling/keycloak-connector-group-auth-plugin (>=0.0.5-alpha.0 <=1.1.15) potentially affected by CVE-2024-53843 via @dapperduckling/keycloak-connector-server (>=0.0.14 <=1.5.2)
@dapperduckling/keycloak-connector-server NPM version =0.0.14, =0.0.5-alpha.0, =0.0.5-alpha.0, =1.1.15 Source cves: CVE-2024-53843 Source advisory: OSV:GHSA-W5RQ-G9R6-VRCG...
Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...
Moderate: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.0 update
A security update is now available for Red Hat JBoss Enterprise Application Platform 8.0. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...
Keycloak: Vulnerable Redirect URI Validation Results in Open Redirec
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially...
CVE-2024-53843 Reflected XSS Vulnerability in Authentication Flow URL Handling in @dapperduckling/keycloak-connector-server
@dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Reflected Cross-Site Scripting XSS vulnerability was discovered in the authentication flow of the application. This issue arises due to...
CVE-2024-53843 Reflected XSS Vulnerability in Authentication Flow URL Handling in @dapperduckling/keycloak-connector-server
@dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Reflected Cross-Site Scripting XSS vulnerability was discovered in the authentication flow of the application. This issue arises due to...
CVE-2024-53843 Reflected XSS Vulnerability in Authentication Flow URL Handling in @dapperduckling/keycloak-connector-server
@dapperduckling/keycloak-connector-server is an opinionated series of libraries for Node.js applications and frontend clients to interface with keycloak. A Reflected Cross-Site Scripting XSS vulnerability was discovered in the authentication flow of the application. This issue arises due to...
GHSA-93WW-43RR-79V3 vulnerabilities
Vulnerabilities for packages: keycloak, keycloak-config-cli...
GHSA-93WW-43RR-79V3 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication...
Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication...
be.jidoka:jdk-keycloak-admin (>=2.0.0 <=2.4.0), ch.iterial.keycloak.plugins:keycloak-directus-plugin (>=0.1.0 <=0.7.0) +679 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (>=1.0-alpha-1 <=26.0.5)
org.keycloak:keycloak-core MAVEN version =1.0-alpha-1, =2.0.0, =0.1.0, =0.0.1, =1.5.1, =1.5.1, =1.6.2, =1.6.2, =1.5.2, =1.5.2, =1.7.2, =1.7.2, =1.0.22, =1.0.22, =1.4.3, =1.4.3, =1.6.5 and more Source cves: CVE-2024-10039 Source advisory: OSV:GHSA-93WW-43RR-79V3...
