CVE-2016-8609: Session Fixation

It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks...

CVE-2018-10894: Insufficient Verification of Data Authenticity

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks...

CVE-2017-2646

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks...

CVE-2017-2646

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks...

Sql injection

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks...

CVE-2017-2646

Keycloak prior to 2.5.5 is affected by CVE-2017-2646. The vulnerability occurs when a Logout request contains an Extensions field in the middle of the request, causing SAMLSloRequestParser.parse() to enter an infinite loop and potentially enable denial-of-service. Affected component: keycloak-sam...

CVE-2017-2646

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks...

CVE-2017-2646: Loop with Unreachable Exit Condition

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks...

CVE-2017-2582

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML...

Design/Logic Flaw

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML...

CVE-2017-2582

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML...

CVE-2017-2582

Technical details for CVE-2017-2582 are not publicly available in the provided documents. Monitor for updates as new information becomes available.

CVE-2017-2582

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML...

CVE-2017-2582: Insertion of Sensitive Information Into Sent Data

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML...

Denial Of Service (DoS) Through Infinite Loop

keycloak-model-infinispan is vulnerable to denial of service DoS attacks through an infinite loop. The vulnerability exists due to an infinite loop that could occur during the replacement of a session where the replacement could fail, causing a DoS...

CVE-2018-10912

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

CVE-2018-10912

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

Code injection

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

CVE-2018-10912

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the...

CVE-2018-10912

Keycloak before 4.0.0.final is vulnerable to an infinite loop in session replacement, which could allow a malicious authenticated user to cause a Denial of Service on a multi-node cluster. Red Hat advisories reference CVE-2018-10912 and list a fix in later releases (e.g., Red Hat SSO 7.2.4) and a...