CVE-2021-3424

CVE-2021-3424 describes an IDN homograph attack in Keycloak as shipped with Red Hat Single Sign-On 7.4, enabling a malicious user to register a name already in use and potentially trick an admin into granting extra privileges. Connected advisories confirm this vulnerability is addressed by Red Ha...

CVE-2021-3424: Improper Authentication

A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges...

[ASA-202106-19] keycloak: incorrect calculation

Arch Linux Security Advisory ASA-202106-19 ========================================== Severity: Low Date : 2021-06-01 CVE-ID : CVE-2021-3461 Package : keycloak Type : incorrect calculation Remote : Yes Link : https://security.archlinux.org/AVG-1994 Summary ======= The package keycloak before...

CVE-2021-20195

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability ...

CVE-2020-27826

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...

CVE-2020-27826

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...

CVE-2021-20195

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability ...

Design/Logic Flaw

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...

Cross site scripting

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability ...

CVE-2021-20195

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability ...

CVE-2021-20195

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability ...

CVE-2021-20195

Summary (CVE-2021-20195) : A Self Stored XSS in Keycloak prior to 13.0.0 allows an attacker to escalate to account takeover by abusing unencoded user-supplied fields processed by JavaScript. Reported impact includes potential compromise of data confidentiality, integrity, and system availability....

CVE-2021-20195

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability ...

CVE-2020-27826

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...

CVE-2020-27826

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...

CVE-2020-27826

The CVE-2020-27826 entry concerns Keycloak prior to 12.0.0, where a flaw in the Account REST API allows updating a user’s metadata attributes, specifically the NameID, enabling an attacker to impersonate the admin user for a given application. The affected component is Keycloak’s account metadata...

PT-2021-13833 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: keycloak versions prior to 13.0.0 Description: A flaw in keycloak allows for a Self Stored XSS attack vector, which can escalate to a complete account takeover. This is due to user-supplied data fields not being properly encoded and the use o...

CVE-2021-20195: Improper Input Validation

A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS attack vector escalating to a complete account takeover is possible due to user-supplied data fields not being properly encoded and Javascript code being used to process the data. The highest threat from this vulnerability ...

PT-2021-11420

Name of the Vulnerable Software and Affected Versions: Keycloak versions prior to 12.0.0 Description: A flaw was found in Keycloak where it is possible to update the user's metadata attributes using the Account REST API. This flaw allows an attacker to change its own NameID attribute to impersona...

CVE-2020-27826: Execution with Unnecessary Privileges

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application...