keycloak: path traversal via double URL encoding

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

keycloak: Session takeover with OIDC offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

Important: Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 7

New Red Hat Single Sign-On 7.6.1 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: path traversal via double URL encoding

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

RHEL 7 : Red Hat Single Sign-On 7.6.1 security update on RHEL 7 (Important) (RHSA-2022:8961)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8961 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

PT-2022-24784 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in the offline access scope in Keycloak, affecting users of shared computers more, especially if cookies are not cleared. This issue is due to a lack of root session...

RHEL 8 : Red Hat Single Sign-On 7.6.1 security update on RHEL 8 (Important) (RHSA-2022:8962)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8962 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

PT-2022-24098 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and acces...

RHEL 9 : Red Hat Single Sign-On 7.6.1 security update on RHEL 9 (Important) (RHSA-2022:8963)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:8963 advisory. Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

CVE-2022-3782

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

Red Hat Keycloak 路径遍历漏洞

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak. An attacker could exploit the vulnerability to perform path traversal via double URL...

Exploit for Cross-site Scripting in Redhat Keycloak

CVE-2021-20323 Description Keycloak before 18.0.0 and afte...

Security Bulletin: Rational Test Automation Server is vulnerable to incorrect authorization vulnerability due to Keycloak (CVE-2021-4133)

Summary Keycloak vulnerability of incorrect authorization impacts Rational Test Automation Server. Vulnerability Details CVEID:CVE-2021-4133 DESCRIPTION: Keycloak could allow a remote authenticated attacker to bypass security restrictions, caused by improper authorization validation by the...

Security Bulletin: Rational Test Automation Server is vulnerable to malicious code execution due to Keycloak (CVE-2021-20222)

Summary Keycloak vulnerability that allows malicious code to be executed impacts Rational Test Automation Server. Vulnerability Details CVEID:CVE-2021-20222 DESCRIPTION: Keycloak is vulnerable to cross-site scripting, caused by improper validation of user-supplied input by the referrer URL in the...

Security Bulletin: Rational Test Automation Server is vulnerable to Allocation of resources without limits vulnerability due to Keycloak (CVE-2021-3637)

Summary Vulnerability related to allocation of resources without limits associated with the Keycloak versions before 14.0.0 impacts Rational Test Automation Server. Vulnerability Details CVEID:CVE-2021-3637 DESCRIPTION: Keycloak is vulnerable to a denial of service, caused by a flaw in the...

GHSA-755V-R4X4-QF7M Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown

Summary A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release 16.0.1. The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the groups' dropdown...

com.blazebit:blaze-storage-client-keycloak (>=0.2.0 <=0.3.3), com.blazebit:blaze-storage-modules-authentication-keycloak (>=0.2.0 <=0.3.3) +257 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (>=1.0-alpha-1 <=1.9.8.Final)

org.keycloak:keycloak-core MAVEN version =1.0-alpha-1, =0.2.0, =0.2.0, =0.2.0, =0.2.0, =0.8.4, =0.2.1, =0.13, =1.1.0.Final, =1.2.2.Final, =1.2.2.Final, =1.0.0.Beta2, =1.2.1.Final, =1.1.2.Final, =1.1.0.Final, =1.2.1.Final and more Source cves: CVE-2022-0225 Source advisory: OSV:GHSA-755V-R4X4-QF7M...

Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown

Summary A Stored XSS vulnerability was reported in the Keycloak Security mailing list, affecting all the versions of Keycloak, including the latest release 16.0.1. The vulnerability allows a privileged attacker to execute malicious scripts in the admin console, abusing of the groups' dropdown...

CVE-2022-3916

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...