com.github.vzakharchenko:chillispot-radius-plugin (1.4.10), com.github.vzakharchenko:cisco-radius-plugin (1.4.10) +15 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (20.0.3)

org.keycloak:keycloak-ldap-federation MAVEN version 20.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.10 -...

org.keycloak:keycloak-dependencies-server-all (3.3.0.cr1), org.keycloak:keycloak-server-feature-pack (3.3.0.cr1) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (3.3.0.cr1)

org.keycloak:keycloak-ldap-federation MAVEN version 3.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.3.0.cr1 -...

EUVD-2025-199598

Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization...

org.keycloak:keycloak-dependencies-server-all (3.3.0.cr2), org.keycloak:keycloak-server-feature-pack (3.3.0.cr2) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (3.3.0.cr2)

org.keycloak:keycloak-ldap-federation MAVEN version 3.3.0.cr2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.3.0.cr2 -...

com.github.vzakharchenko:chillispot-radius-plugin (1.4.11), com.github.vzakharchenko:cisco-radius-plugin (1.4.11) +15 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (21.0.0)

org.keycloak:keycloak-ldap-federation MAVEN version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - com.github.vzakharchenko:chillispot-radius-plugin 1.4.11 -...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=2.5.6-24.0, <=2.7.4-24.0), org.keycloak:keycloak-dependencies-server-all (24.0.2) +7 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (24.0.2)

org.keycloak:keycloak-ldap-federation MAVEN version 24.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - de.arbeitsagentur.opdt:keycloak-cassandra-model-tests =2.5.6-24.0, =2.7.4-24.0 -...

org.keycloak:keycloak-dependencies-server-all (10.0.2), org.keycloak:keycloak-server-feature-pack (10.0.2) +2 more potentially affected by CVE-2025-13467 via org.keycloak:keycloak-ldap-federation (10.0.2)

org.keycloak:keycloak-ldap-federation MAVEN version 10.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-ldap-federation and may be impacted: - org.keycloak:keycloak-dependencies-server-all 10.0.2 -...

GHSA-4HX9-48XH-5MXR Keycloak LDAP User Federation provider enables admin-triggered untrusted Java deserialization

A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration. Mitigation Disable LDAP referrals in all LDAP user providers in all realms...

CVE-2025-14777

A flaw was found in Keycloak. An IDOR Broken Access Control vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer client ID provided in the A...

CVE-2025-14777

A flaw was found in Keycloak. An IDOR Broken Access Control vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer client ID provided in the A...

CVE-2025-14777

Keycloak vulnerability CVE-2025-14777 is an IDOR in admin API endpoints for authorization resource management, affecting ResourceSetService and PermissionTicketService. The backend uses resourceId for DB lookups while authorization checks compare the resourceServer (client) ID provided in the req...

CVE-2025-14777 Keycloak: keycloak idor in realm client creating/deleting

A flaw was found in Keycloak. An IDOR Broken Access Control vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer client ID provided in the A...

EUVD-2025-203501

A flaw was found in Keycloak. An IDOR Broken Access Control vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer client ID provided in the A...

CVE-2025-14777 Keycloak: keycloak idor in realm client creating/deleting

A flaw was found in Keycloak. An IDOR Broken Access Control vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer client ID provided in the A...

CVE-2025-14777

A flaw was found in Keycloak. An IDOR Broken Access Control vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer client ID provided in the A...

Authentication Bypass by Alternate Name

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name via the ResourceSetService and PermissionTicketService modules due to...

CVE-2025-14777: Authentication Bypass by Alternate Name

A flaw was found in Keycloak. An IDOR Broken Access Control vulnerability exists in the admin API endpoints for authorization resource management, specifically in ResourceSetService and PermissionTicketService. The system checks authorization against the resourceServer client ID provided in the A...

PT-2025-51367

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A broken access control issue was identified in Keycloak’s admin API endpoints related to authorization resource management, specifically within the ResourceSetService and...

Keycloak 安全漏洞

Keycloak is an open source identity and access management solution from Keycloak Open Source. A security vulnerability exists in Keycloak that stems from improper access control of the Authorized Resource Management API endpoint, which could result in unauthorized deletion or update of resources...

Information Exposure

ansible-collection-community-general is vulnerable to Information Exposure. The vulnerability is due to verbose debug output exposing sensitive credentials such as plaintext passwords, which allows an attacker with access to logs to retrieve these secrets and potentially compromise Keycloak...