io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0), net.optionfactory.keycloak:optionfactory-keycloak-cie (>=2.1 <=2.16) +45 more potentially affected by CVE-2024-8698 via org.keycloak:keycloak-saml-core (>=1.2.0.CR1 <=22.0.1)

org.keycloak:keycloak-saml-core MAVEN version =1.2.0.CR1, =0.1.0, =2.1, =2.1, =1.2.0.CR1, =1.2.0.CR1, =20.0.0, =20.0.0, =21.1.0, =20.0.0, =20.0.0, =20.0.0, =20.0.0, =1.9.2.Final, =1.6.0.Final, =21.1.0, =22.0.1 and more Source cves: CVE-2024-8698 Source advisory: OSV:GHSA-XGFV-XPX8-QHCR...

GHSA-XGFV-XPX8-QHCR vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-XGFV-XPX8-QHCR vulnerabilities

Vulnerabilities for packages: keycloak...

Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...

GHSA-XGFV-XPX8-QHCR Improper Verification of SAML Responses Leading to Privilege Escalation in Keycloak

A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the XML document, rather than the Referen...

CVE-2024-3656

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise...

CVE-2024-3656 vulnerabilities

Vulnerabilities for packages: keycloak-fips...

CVE-2024-3656 Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise...

CVE-2024-3656 Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise...

CVE-2024-3656 Keycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise...

CVE-2024-3656

A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. Mitigation Mitigation...

PT-2024-39748 · Red Hat · Keycloak Server

Name of the Vulnerable Software and Affected Versions: Keycloak Server affected versions not specified Description: A denial of service DoS attack is possible due to improper handling of proxy headers in the Keycloak Server. When configured to accept incoming proxy headers, Keycloak may accept...

keycloak -- Missing server identity checks when sending mails via SMTPS

Red Hat reports: A vulnerability was found in Apache Sling Commons Messaging Mailangus-mail, which provides a simple interface for sending emails via SMTPS in OSGi, does not offer an option to enable server identity checks, leaving connections vulnerable to "man-in-the-middle" attacks and can all...

Open Redirection

org.keycloak,keycloak-services is vulnerable to Open Redirect. The vulnerability is due to improper validation of the "Valid Redirect URI" field, which can allow attackers to redirect users to arbitrary URLs, potentially exposing sensitive information...

Improper Verification Of Cryptographic Signature

Keycloak is vulnerable to an Improper Verification of Cryptographic Signature. The vulnerability is due to incorrect validation logic in the XMLSignatureUtil class, where the SAML signature's scope is determined based on its position in the XML document, rather than using the Reference element th...

GHSA-4XX7-2CX3-X473 Duplicate Advisory: Keycloak SAML signature validation flaw

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xgfv-xpx8-qhcr. This link is maintained to preserve external references. Original Description A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method...

GHSA-VVF8-2H68-9475 Duplicate Advisory: Keycloak Open Redirect vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-w8gr-xwp4-r9f7. This link is maintained to preserve external references. Original Description A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL...

GHSA-4XX7-2CX3-X473 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-4XX7-2CX3-X473 vulnerabilities

Vulnerabilities for packages: keycloak...

Duplicate Advisory: Keycloak SAML signature validation flaw

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xgfv-xpx8-qhcr. This link is maintained to preserve external references. Original Description A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method...