CVE-2021-20195

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability ...

CVE-2021-20195

Summary (CVE-2021-20195) : A Self Stored XSS in Keycloak prior to 13.0.0 allows an attacker to escalate to account takeover by abusing unencoded user-supplied fields processed by JavaScript. Reported impact includes potential compromise of data confidentiality, integrity, and system availability....

CVE-2020-27826

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...

CVE-2020-27826

The CVE-2020-27826 entry concerns Keycloak prior to 12.0.0, where a flaw in the Account REST API allows updating a user’s metadata attributes, specifically the NameID, enabling an attacker to impersonate the admin user for a given application. The affected component is Keycloak’s account metadata...

PT-2021-13833 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: keycloak versions prior to 13.0.0 Description: A flaw in keycloak allows for a Self Stored XSS attack vector, which can escalate to a complete account takeover. This is due to user-supplied data fields not being properly encoded and the use o...

Insecure Session Management

keycloak uses an insecure session management. The application may fail to invalidate user session if the logout request comes from external SAML identity provider that is set up to identify principal via attributes rather than Subject Name ID...

User Impersonation

keycloak is vulnerable to user impersonation. A Internationalized domain name IDN homograph attack allows an attacker to impersonate a user...

keycloak: Backchannel logout not working when Principal Type is set to Attribute Name for external SAML IDP

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.7 security update

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: Internationalized domain name (IDN) homograph attack to impersonate users

A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity...

keycloak: Backchannel logout not working when Principal Type is set to Attribute Name for external SAML IDP

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

keycloak: Internationalized domain name (IDN) homograph attack to impersonate users

A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity...

keycloak: Internationalized domain name (IDN) homograph attack to impersonate users

A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity...

keycloak: Backchannel logout not working when Principal Type is set to Attribute Name for external SAML IDP

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

keycloak: Internationalized domain name (IDN) homograph attack to impersonate users

A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.7 security update on RHEL 6

New Red Hat Single Sign-On 7.4.7 packages are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: Backchannel logout not working when Principal Type is set to Attribute Name for external SAML IDP

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute Name...

Red Hat Keycloak代码问题漏洞

Red Hat Keycloak is a suite of software from Red Hat USA that provides authentication and management capabilities for modern applications and services. A code issue vulnerability exists in Red Hat Keycloak Code Issue Vulnerability. No information about this vulnerability is available at this time...

RHEL 7 : Red Hat Single Sign-On 7.4.7 security update on RHEL 7 (Moderate) (RHSA-2021:2064)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2064 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 6 : Red Hat Single Sign-On 7.4.7 security update on RHEL 6 (Moderate) (RHSA-2021:2063)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2063 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...