CVE-2024-1722 Keycloak-core: dos via account lockout

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in...

CVE-2024-1722 Keycloak-core: dos via account lockout

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in...

CVE-2024-21742 vulnerabilities

Vulnerabilities for packages: keycloak, opensearch...

CVE-2024-21742 vulnerabilities

Vulnerabilities for packages: opensearch, keycloak...

The vulnerability of the Keycloak identity and access management software lies in its overly restrictive mechanism for blocking user accounts. This allows a malicious user to lock out the user from accessing their account.

The vulnerability of the Keycloak identity and access management software lies in its overly restrictive mechanism for blocking user accounts. Exploiting this vulnerability could allow a malicious actor to remotely block a user’s access to their account...

CVE-2024-1722: Overly Restrictive Account Lockout Mechanism

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in...

GHSA-24RP-Q3W6-VC56 vulnerabilities

Vulnerabilities for packages: dependency-track, trino, mariadb, keycloak...

GHSA-24RP-Q3W6-VC56 vulnerabilities

Vulnerabilities for packages: keycloak, dependency-track, trino, mariadb...

CVE-2024-1722

A flaw was found in Keycloak. In certain conditions, this issue may allow a remote unauthenticated attacker to block other accounts from logging in. Mitigation Red Hat Product Security is not aware of a way to completely mitigate this issue. However, the following techniques can be used to help...

Red Hat Keycloak Authorization Issues Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. Red Hat Keycloak suffers from an authorization issue vulnerability that stems from the presence of an authentication error vulnerability...

PT-2024-1836 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: A flaw was found in Keycloak, which may allow a remote unauthenticated attacker to block other accounts from logging in under certain conditions. This issue is related to an overly...

PT-2024-2167 · Red Hat · Keycloak

Name of the Vulnerable Software and Affected Versions: Keycloak affected versions not specified Description: The issue is related to a flaw in the re-authentication mechanism within Keycloak, specifically in the org.keycloak.authentication module. This flaw allows an attacker to hijack an active...

Red Hat Keycloak Security Vulnerability

Red Hat Keycloak is a suite of software from Red Hat, Inc. that provides authentication and management capabilities for modern applications and services. A security vulnerability exists in Red Hat Keycloak that originates from a vulnerability that could allow an unauthenticated, remote attacker t...

GHSA-XFG6-62PX-CXC2 vulnerabilities

Vulnerabilities for packages: keycloak-fips, dependency-track, mariadb, keycloak, trino...

GHSA-XFG6-62PX-CXC2 vulnerabilities

Vulnerabilities for packages: trino, keycloak, dependency-track, mariadb...

CVE-2024-1597 vulnerabilities

Vulnerabilities for packages: keycloak, dependency-track, trino, mariadb...

CVE-2024-1597 vulnerabilities

Vulnerabilities for packages: dependency-track, trino, mariadb, keycloak...

keycloak: open redirect via "form_post.jwt" JARM response mode

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt" which could be used to bypass the security patch implemented to address CVE-2023-6134...

keycloak: reflected XSS via wildcard in OIDC redirect_uri

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting XSS or further attacks. This flaw is the result of an incomple...

keycloak: Log Injection during WebAuthn authentication or registration

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity...