Insufficient Permission Check

keycloak is vulnerable to insufficient permission check.User can manage resources with just "view-profile" role using new Account Console.Allowing access and modification of data the user was not intended to have...

Cross-site Scripting (XSS)

keycloak is vulnerable to cross-site scripting XSS. OIDC redirecturi allows dangerous schemes resulting in potential XSS...

RHEL 6 : Red Hat Single Sign-On 7.4.3 security update on RHEL 6 (Moderate) (RHSA-2020:4929)

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4929 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 7 : Red Hat Single Sign-On 7.4.3 security update on RHEL 7 (Moderate) (RHSA-2020:4930)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4930 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

RHEL 8 : Red Hat Single Sign-On 7.4.3 security update on RHEL 8 (Moderate) (RHSA-2020:4932)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:4932 advisory. Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single...

keycloak: user can manage resources with just "view-profile" role using new Account Console

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update on RHEL 8

New Red Hat Single Sign-On 7.4.3 packages are now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS

A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack...

keycloak: user can manage resources with just "view-profile" role using new Account Console

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update on RHEL 6

New Red Hat Single Sign-On 7.4.3 packages are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS

A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update on RHEL 7

New Red Hat Single Sign-On 7.4.3 packages are now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS

A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack...

keycloak: user can manage resources with just "view-profile" role using new Account Console

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission...

keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS

A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack...

keycloak: path traversal in resources

A flaw was found in keycloak. A path traversal, using URL-encoded path segments in a request, is possible due to transformation of the URL path to a file path at the resource endpoint. The highest threat from this vulnerability is to data confidentiality...

keycloak: user can manage resources with just "view-profile" role using new Account Console

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission...

Moderate: Red Hat Security Advisory: Red Hat Single Sign-On 7.4.3 security update

A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2020-14389

A flaw was found in Keycloak, where it would permit a user with a view-profile role to manage the resources in the new account console. This flaw allows a user with a view-profile role to access and modify data for which the user does not have adequate permission...

CVE-2020-10776

A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack. Mitigation Trusted Hosts Policy could be used to mitigate this attack :...