CVE-2022-2237

A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function...

CVE-2022-2237

A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function...

Red Hat Keycloak 信任管理问题漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that originates from allowing unintended access to untrusted certificates when used to...

CVE-2022-2237

A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function...

CVE-2022-2237

CVE-2022-2237 describes an Open Redirect in the Keycloak Node.js Adapter, exploitable via the checkSso flow (and checkSSO with prompt=none). Multiple connected sources corroborate the Open Redirect issue (GHSA advisory, OSV entries, CVE records, RHSA/RH listings). The PT-Security entry notes affe...

keycloak: path traversal via double URL encoding

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

Open Redirect

keycloak-connect is vulnerable to Open Redirect. The vulnerability exists in the module.exports function of the check-sso.js as it does not properly escape the slashes in the cleanUrl attribute, allowing an attacker to redirect the user to malicious urls with query param prompt=none when checking...

Exploit for Improper Authentication in Redhat Keycloak

PoC for CVE-2023-0264 Keycloak vulnerability that allows ses...

User Impersonation

keycloak-services is vulnerable to User Impersonation. The vulnerability is due to the OpenID Connect user authentication because the session UUID is not properly bound to the user session, allowing an attacker to obtain a certain piece of information from a user request in the same realm and...

HTML Injection

org.keycloak:keycloak-services is vulnerable to HTML Injection. A malicious user is able to send emails containing phishing links to users via the execute-actions-email endpoint of the admin REST API...

Keycloak vulnerable to user impersonation via stolen UUID code

Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session...

GHSA-9G98-5MJ6-F9MV Keycloak vulnerable to user impersonation via stolen UUID code

Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session...

com.github.vzakharchenko:chillispot-radius-plugin (>=1.4.10 <=1.4.11), com.github.vzakharchenko:cisco-radius-plugin (>=1.4.10 <=1.4.11) +55 more potentially affected by CVE-2023-0264 via org.keycloak:keycloak-services (>=1.0-alpha-1 <=21.0.0)

org.keycloak:keycloak-services MAVEN version =1.0-alpha-1, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =1.4.10, =0.3.0-20.0.1, =0.4.5-20.0.2, =1.3.2, =0.6, =0.2, =0.7 and more Source cves: CVE-2023-0264 Source advisory: OSV:GHSA-9G98-5MJ6-F9MV...

@aerogear/voyager-keycloak (>=0.8.1-dev.422.e25a8f8.0 <=0.9.1-dev.435.8d846ff.0), @aerogear/voyager-server (>=0.8.1-dev.414.e43c5aa.0 <=0.9.1-dev.435.8d846ff.0) +70 more potentially affected by CVE-2022-2237 via keycloak-connect (>=10.0.2 <=20.0.5)

keycloak-connect NPM version =10.0.2, =0.8.1-dev.422.e25a8f8.0, =0.8.1-dev.414.e43c5aa.0, =0.8.1-dev.414.e43c5aa.0, =1.0.0-alpha.0, =5.1.2, =0.1.0, =0.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.3, =1.0.3, =1.1.7 and more Source cves: CVE-2022-2237 Source advisory: OSV:GHSA-59FQ-727J-HM3F...

GHSA-59FQ-727J-HM3F keycloak-connect contains Open redirect vulnerability in the Node.js adapter

There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using checkSSO with query param prompt=none...

keycloak-connect contains Open redirect vulnerability in the Node.js adapter

There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using checkSSO with query param prompt=none...

Cross-site Scripting (XSS)

org.keycloak:keycloak-services is vulnerable to Cross-site Scripting XSS attacks. A remote attacker is able to insert an arbitrary URI into an error page via the oob OAuth endpoint due to incorrect null-byte handling...

PT-2023-2764 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak's OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request...

The vulnerability of the Keycloak identity and access management software lies in its default access rights settings, which allow a malicious actor to execute arbitrary code.

The vulnerability of the Keycloak identity and access management software is related to the default access rights settings. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

PT-2023-12689 · Red Hat · Keycloak Node.Js Adapter

Name of the Vulnerable Software and Affected Versions: Keycloak Node.js Adapter affected versions not specified Description: A flaw was found in the Keycloak Node.js Adapter, allowing an attacker to benefit from an Open Redirect vulnerability in the checkSso function. This issue is also present...