CVE-2023-49594

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin...

CVE-2023-49594

Information disclosure vulnerability in instipod DuoUniversalKeycloakAuthenticator for Keycloak (version 1.0.7). Talos details show that during initial authentication, the extension redirects via Response.temporaryRedirect to duosecurity.com, causing the browser to send the user’s username and pa...

CVE-2023-49594

An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user logging into Keycloak using DuoUniversalKeycloakAuthenticator plugin...

instipod DuoUniversalKeycloakAuthenticator challenge information disclosure vulnerability

Talos Vulnerability Report TALOS-2023-1907 instipod DuoUniversalKeycloakAuthenticator challenge information disclosure vulnerability December 23, 2023 CVE Number CVE-2023-49594 SUMMARY An information disclosure vulnerability exists in the challenge functionality of instipod...

PT-2023-31270 · Duo · Duouniversalkeycloakauthenticator

Name of the Vulnerable Software and Affected Versions: DuoUniversalKeycloakAuthenticator version 1.0.7 Description: An information disclosure vulnerability exists in the challenge functionality of the DuoUniversalKeycloakAuthenticator plugin. A specially crafted HTTP request can lead to a...

DuoUniversalKeycloakAuthenticator Security Vulnerability

DuoUniversalKeycloakAuthenticator is a Keycloak authenticator by Michael Kelly Personal Developer. A security vulnerability exists in DuoUniversalKeycloakAuthenticator version 1.0.7, which stems from the presence of an information disclosure vulnerability, where a specially crafted HTTP request...

Open Redirect

Keycloak Services is vulnerable to Open Redirect. The vulnerability is due to the redirecturi validation logic within RedirectUtils.java. This allows an attacker to steal an access token by bypassing the allowed host validation...

com.charlyghislain.keycloak:keycloak-importexport (=21.0.0), com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.10 <=1.4.11) +84 more potentially affected by CVE-2023-6291 via org.keycloak:keycloak-services (>=1.0-alpha-1 <=23.0.2)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.1.23, =0.3.0-20.0.1, =0.4.5-20.0.2, =1.0.1, =1.1.4, =1.1.5 and more Source cves: CVE-2023-6291 Source advisory: OSV:GHSA-MPWQ-J3XF-7M5W...

GHSA-MPWQ-J3XF-7M5W The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted

An issue was found in the redirecturi validation logic that allows for a bypass of otherwise explicitly allowed hosts. The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and...

The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted

An issue was found in the redirecturi validation logic that allows for a bypass of otherwise explicitly allowed hosts. The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and...

CVE-2023-2585

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized acce...

CVE-2023-2585

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized acce...

CVE-2023-2585

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized acce...

Authorization

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized acce...

CVE-2023-2585 Keycloak: client access via device auth request spoof

Keycloak's device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized acce...

CVE-2023-2585

CVE-2023-2585 concerns Keycloak’s Device Authorization Grant, where flawed validation of device_code and client_id could allow a malicious OAuth client to spoof a consent request and trick an admin into granting access to other OAuth clients or cause unauthorized access. Connected sources corrobo...

Cross-Site Scripting (XSS)

Keycloak Services is vulnerable to Cross Site Scripting XSS Attacks. The vulnerability is due to the matchesRedirects method utils/RedirectUtils.java missing some redirection URL sanitization. This could allow an attacker to submit a specially crafted request leading to XSS...

Duplicate Advisory: Keycloak Open Redirect vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9vm7-v8wj-3fqw. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients...

GHSA-3P75-Q5CC-QMJ7 Duplicate Advisory: Keycloak Open Redirect vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9vm7-v8wj-3fqw. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients...

PT-2023-32593 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in the redirect uri validation logic in Keycloak, which may allow a bypass of otherwise explicitly allowed hosts. This issue arises due to a desynchronization in how...