Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.8 enhancement and security update on RHEL 7

New Red Hat Single Sign-On 7.6.8 deliverables are now available for Red Hat Enterprise Linux 7. This is an enhancement and security update with Important impact rating and package name 'rh-sso7-keycloak'. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity ratin...

keycloak: Log Injection during WebAuthn authentication or registration

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity...

keycloak: path transversal in redirection validation

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects a...

PT-2024-5147 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS,...

Red Hat Keycloak 授权问题漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. An authorization issue vulnerability exists in Red Hat Keycloak that stems from an inability to perform proper authentication. An attacker coul...

io.hawt:hawtio-wildfly (=2.17.7), io.kokuwa.keycloak:keycloak-event-metrics (>=0.1.0 <=1.0.0) +133 more potentially affected by CVE-2023-6236 via org.wildfly.security:wildfly-elytron-http-oidc (>=1.15.7.Final <=2.2.4.Final)

org.wildfly.security:wildfly-elytron-http-oidc MAVEN version =1.15.7.Final, =0.1.0, =9.4.45.v20220203, =9.4.45.v20220203, =9.4.45.v20220203, =10.0.8, =12.0.1, =12.0.1, =12.0.1, =10.0.10, =13.0.0.CR1, =3.1.0.Final, =3.1.1.Alpha1 - org.jboss.resteasy.spring:galleon-feature-pack-layers-metadata-test...

GHSA-F8H5-V2VG-46RR vulnerabilities

Vulnerabilities for packages: keycloak-operator...

GHSA-F8H5-V2VG-46RR vulnerabilities

Vulnerabilities for packages: keycloak-operator...

CVE-2024-2700 vulnerabilities

Vulnerabilities for packages: keycloak-operator...

CVE-2024-2700 vulnerabilities

Vulnerabilities for packages: keycloak-operator...

CVE-2024-29025 vulnerabilities

Vulnerabilities for packages: cloudwatch-exporter, opensearch, selenium, keycloak, druid, tez, sonarqube-10, wavefront-proxy...

CVE-2024-29025 vulnerabilities

Vulnerabilities for packages: tez, elasticsearch, wavefront-proxy, cloudwatch-exporter, seata, management-api-for-apache-cassandra-4.0, spark, opensearch, selenium, druid, sonarqube-10, keycloak, celeborn...

The vulnerability of the Keycloak identity and access management software lies in implementation errors related to authentication procedures, allowing attackers to circumvent security restrictions.

The vulnerability of the Keycloak identity and access management software is related to errors in the implementation of authentication procedures. Exploiting this vulnerability can allow a malicious actor to circumvent security restrictions remotely...

keycloak: XSS via assertion consumer service URL in SAML POST-binding flow

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs ACS, posing a Cross-Site Scripting XSS risk. This issue may allow a malicious admin in one realm or a client with...

The vulnerability of the Keycloak identity and access management software lies in its authentication procedures’ flaws, which allow attackers to intercept active sessions.

The vulnerability of the Keycloak identity and access management software is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to intercept an active session...

Duplicate Advisory: Keycloak DoS via account lockout

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cq42-vhv7-xr7p. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block...

GHSA-3HRR-XWVG-HXVR Duplicate Advisory: Keycloak DoS via account lockout

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cq42-vhv7-xr7p. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block...

CVE-2024-1722

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in...

Design/Logic Flaw

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in...

CVE-2024-0560

A vulnerability was found in 3Scale, when used with Keycloak 15 or RHSSO 7.5.0 and superiors. When the authtype is use3scaleoidcissuerendpoint, the Token Introspection policy discovers the Token Introspection endpoint from the tokenintrospectionendpoint field, but the field was removed on RH-SSO...