CVE-2022-3916

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

CVE-2022-3916

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

Design/Logic Flaw

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

CVE-2022-3916

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

CVE-2022-3916 Keycloak: session takeover with oidc offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

CVE-2022-3916 Keycloak: session takeover with oidc offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

CVE-2022-3916 Keycloak: session takeover with oidc offline refreshtokens

A flaw was found in the offlineaccess scope in Keycloak. This issue would affect users of shared computers more especially if cookies are not cleared, due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to...

CVE-2022-3916

CVE-2022-3916 affects Keycloak via the offline_access scope. The flaw arises from missing root-session validation and reuse of session IDs between root and user authentication sessions, enabling an attacker to resolve a user session attached to a previously authenticated user; using the refresh t...

CVE-2022-1438

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability...

CVE-2022-1438

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability...

CVE-2022-1438

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability...

Cross site scripting

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability...

CVE-2022-1438 Keycloak: xss on impersonation under specific circumstances

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability...

CVE-2022-1438

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability...

CVE-2022-1438 Keycloak: xss on impersonation under specific circumstances

A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting XSS vulnerability...

CVE-2022-1438

CVE-2022-1438 is an XSS vulnerability in Keycloak where HTML entities are not sanitized during user impersonation. Red Hat advisories (RHSA-2023:1043/1044/1045) fix this issue in Red Hat Single Sign-On 7.6.2 on RHEL 7/8/9. The NVD CVSS data indicates a MEDIUM to HIGH impact depending on the vecto...

io.quarkus:quarkus-keycloak-authorization-deployment (1.5.0.final) potentially affected by CVE-2023-4853 via io.quarkus:quarkus-keycloak-authorization (1.5.0.final)

io.quarkus:quarkus-keycloak-authorization MAVEN version 1.5.0.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-keycloak-authorization and may be impacted: - io.quarkus:quarkus-keycloak-authorization-deployment 1.5.0.final Source...

io.quarkus:quarkus-keycloak-authorization-deployment (1.7.2.final) potentially affected by CVE-2023-4853 via io.quarkus:quarkus-keycloak-authorization (1.7.2.final)

io.quarkus:quarkus-keycloak-authorization MAVEN version 1.7.2.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-keycloak-authorization and may be impacted: - io.quarkus:quarkus-keycloak-authorization-deployment 1.7.2.final Source...

io.quarkus:quarkus-keycloak-authorization-deployment (1.9.1.final) potentially affected by CVE-2023-4853 via io.quarkus:quarkus-keycloak-authorization (1.9.1.final)

io.quarkus:quarkus-keycloak-authorization MAVEN version 1.9.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-keycloak-authorization and may be impacted: - io.quarkus:quarkus-keycloak-authorization-deployment 1.9.1.final Source...

io.quarkus:quarkus-keycloak-authorization-deployment (1.7.1.final) potentially affected by CVE-2023-4853 via io.quarkus:quarkus-keycloak-authorization (1.7.1.final)

io.quarkus:quarkus-keycloak-authorization MAVEN version 1.7.1.final is affected by a known vulnerability. The following packages have a transitive dependency on io.quarkus:quarkus-keycloak-authorization and may be impacted: - io.quarkus:quarkus-keycloak-authorization-deployment 1.7.1.final Source...