CVE-2020-10686

CVE-2020-10686 affects Keycloak versions 8.0.2 and 9.0.0, with a fix in 9.0.1. A malicious user can register as themselves and then use the remove devices form to post different credential IDs, potentially removing MFA devices for other users. Affected software: Keycloak server (8.0.2–9.0.0). Roo...

CVE-2020-10686

A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users...

CVE-2020-10686

A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users...

PT-2020-12283 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak versions 8.0.2 through 9.0.0 Description: A flaw was found where a malicious user can register as oneself and then use the "remove devices" form to post different credential IDs with the hope of removing MFA devices for other users...

CVE-2020-10686: Improper Authorization

A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users...

CVE-2019-10169

A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running...

CVE-2019-10170

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the...

CVE-2020-10686

A flaw was found in Keycloak version 8.0.2 and 9.0.0, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users...

Information Disclosure

keycloak-core is susceptible to information disclosure. The password credential disclosure is possible because of generation of a random admin password when installing Keycloak and deploying the same password to the same OpenShift namespace...

Missing HTTP Security Headers

keycloak does not contain security headers in its server responses. The lack of these headers does not directly lead to a vulnerability, however it reduces the restrictions of an attacker and aids them in their efforts in the event of a successful exploit of a web vulnerability...

Cross-site Scripting (XSS)

keycloak-core is vulnerable to cross-site scripting XSS. The vulnerability exists as the external applications Application Links used in the admin console are not validated...

GHSA-3GG7-9Q2X-79FC Improper Restriction of Rendered UI Layers or Frames in Keycloak

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other...

Improper Restriction of Rendered UI Layers or Frames in Keycloak

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other...

GHSA-6PMV-7PR9-CGRJ Predictable password in Keycloak

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,community only where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace...

Predictable password in Keycloak

A flaw was found in all versions of the Keycloak operator, before version 8.0.2,community only where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace...

GHSA-8VF3-4W62-M3PQ XSS in Keycloak

It was found in all keycloak versions before 9.0.0 that links to external applications Application Links in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further...

XSS in Keycloak

It was found in all keycloak versions before 9.0.0 that links to external applications Application Links in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further...

GHSA-XFQH-7356-VQJJ Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information...

Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information...

CVE-2018-14655

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'responsemode=formpost' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login...