10821 matches found
Origin Validation Error
Overview org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Origin Validation Error via the review profile process. An attacker can gain unauthorized access to...
GHSA-GJ52-35XM-GXJH Duplicate Advisory: Keycloak phishing attack via email verification step in first login flow
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-xhpr-465j-7p9q. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account...
CVE-2025-7365
A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...
CVE-2025-7365
A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...
CVE-2025-7365 Keycloak: phishing attack via email verification step in first login flow
A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...
CVE-2025-7365
Keycloak vulnerability CVE-2025-7365 involves an IdP login flow where an authenticated attacker merging accounts can alter their email to match a victim’s, triggering a verification email to the victim. If the victim clicks the verification link, the attacker could gain access to the victim’s acc...
CVE-2025-7365 Keycloak: phishing attack via email verification step in first login flow
A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...
CVE-2025-7365 Keycloak: phishing attack via email verification step in first login flow
A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...
CVE-2025-7365: Origin Validation Error
A flaw was found in Keycloak. When an authenticated attacker attempts to merge accounts with another existing account during an identity provider IdP login, the attacker will subsequently be prompted to "review profile" information. This vulnerability allows the attacker to modify their email...
PT-2025-29098
Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw exists in Keycloak that allows an authenticated attacker to potentially gain access to a victim's account. During an identity provider IdP login, if an attacker attempts to merge...
Keycloak 访问控制错误漏洞
Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an access control error vulnerability that stems from a flaw in the account merge function during identity provider login, which could allow an attacker to gain access to a victim's...
keycloak:SamlValidationUtilFuzzer: Security exception in java.base/java.lang.String.encodeWithEncoder
Detailed Report: https://oss-fuzz.com/testcase?key=5596315306491904 Project: keycloak Fuzzing Engine: libFuzzer Fuzz Target: SamlValidationUtilFuzzer Job Type: libfuzzerasankeycloak Platform Id: linux Crash Type: Security exception Crash Address: Crash State:...
org.infinispan:infinispan-quarkus-cli (15.0.13.final), org.infinispan:infinispan-server-integration (15.0.13.final) +18 more potentially affected by CVE-2025-5731 via org.infinispan:infinispan-cli-client (15.0.13.final)
org.infinispan:infinispan-cli-client MAVEN version 15.0.13.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-cli-client and may be impacted: - org.infinispan:infinispan-quarkus-cli 15.0.13.final -...
Red Hat Build of Keycloak Information Disclosure Vulnerability
Red Hat build of Keycloak is a web application for single sign-on from Red Hat, Inc. An information disclosure vulnerability exists in the Red Hat build of Keycloak, which originates from the /admin/serverinfo endpoint that contains internal server details, and can be exploited by an attacker to...
CVE-2025-5416
A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information...
CVE-2025-5416
A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information...
CVE-2025-5416 Keycloak-core: keycloak environment information
A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information...
CVE-2025-5416 Keycloak-core: keycloak environment information
A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information...
CVE-2025-5416
CVE-2025-5416 concerns Keycloak exposing sensitive environment information via the authenticated-accessible endpoint /admin/serverinfo . Multiple sources describe an information-disclosure flaw that can reveal internal server details when an authenticated user accesses the endpoint. The NVD and R...
CVE-2025-5416
A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure. While it requires an already authenticated user, the /admin/serverinfo endpoint can inadvertently provide sensitive environment information...