org.keycloak:keycloak-account-freemarker (1.0-beta-2), org.keycloak:keycloak-login-freemarker (1.0-beta-2) potentially affected by CVE-2025-8419 via org.keycloak:keycloak-services (1.0-beta-2)

org.keycloak:keycloak-services MAVEN version 1.0-beta-2 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0-beta-2 - org.keycloak:keycloak-login-freemarker...

org.keycloak:keycloak-dependencies-server-all (10.0.0), org.keycloak:keycloak-dependencies-server-min (10.0.0) +5 more potentially affected by CVE-2025-8419 via org.keycloak:keycloak-services (10.0.0)

org.keycloak:keycloak-services MAVEN version 10.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-dependencies-server-all 10.0.0 - org.keycloak:keycloak-dependencies-server-m...

org.keycloak:keycloak-authz-policy-drools (3.3.0.cr1), org.keycloak:keycloak-dependencies-server-all (3.3.0.cr1) +6 more potentially affected by CVE-2025-8419 via org.keycloak:keycloak-services (3.3.0.cr1)

org.keycloak:keycloak-services MAVEN version 3.3.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-authz-policy-drools 3.3.0.cr1 -...

org.keycloak:keycloak-account-freemarker (1.0.3.final), org.keycloak:keycloak-dependencies-server-all (1.0.3.final) +3 more potentially affected by CVE-2025-8419 via org.keycloak:keycloak-services (1.0.3.final)

org.keycloak:keycloak-services MAVEN version 1.0.3.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - org.keycloak:keycloak-account-freemarker 1.0.3.final -...

de.adorsys.sts:keycloak-storage-provider (>=0.29.1, <=0.29.10), dk.grinn.keycloak:keycloak-migrate-resource (>=0.0.6, <=1.0.11) +9 more potentially affected by CVE-2025-8419 via org.keycloak:keycloak-services (6.0.1)

org.keycloak:keycloak-services MAVEN version 6.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-services and may be impacted: - de.adorsys.sts:keycloak-storage-provider =0.29.1, =0.0.6, =0.0.6, =1.0.11 -...

CVE-2025-58056 vulnerabilities

Vulnerabilities for packages: docker-selenium, akhq, trino, flyway, tez, apache-nifi, opensearch, apache-activemq-artemis, strimzi-kafka-operator, sonarqube, druid, thingsboard, apicurio-registry, wildfly, zipkin, kserve-modelmesh, celeborn, selenium, wavefront-proxy...

GHSA-FGHV-69VJ-QJ49 vulnerabilities

Vulnerabilities for packages: docker-selenium, akhq, trino, flyway, tez, apache-nifi, opensearch, apache-activemq-artemis, strimzi-kafka-operator, sonarqube, druid, thingsboard, apicurio-registry, wildfly, zipkin, kserve-modelmesh, celeborn, selenium, wavefront-proxy...

CVE-2025-58056 vulnerabilities

Vulnerabilities for packages: keycloak-fips, trino, localstack, druid, wavefront-proxy, kserve-modelmesh, strimzi-kafka-operator, elasticsearch, management-api-for-apache-cassandra-4.0, keycloak, kayenta-fips, celeborn, logstash, management-api-for-apache-cassandra-4.1, knative-kafka-broker,...

GHSA-FGHV-69VJ-QJ49 vulnerabilities

Vulnerabilities for packages: keycloak-fips, trino, localstack, druid, wavefront-proxy, kserve-modelmesh, strimzi-kafka-operator, elasticsearch, management-api-for-apache-cassandra-4.0, keycloak, kayenta-fips, celeborn, logstash, management-api-for-apache-cassandra-4.1, knative-kafka-broker,...

Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gc-wj6x-9w55. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescriptio...

GHSA-XMCW-MV9P-7PQ2 Duplicate Advisory: Keycloak error_description injection on error pages that can trigger phishing attacks

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-27gc-wj6x-9w55. This link is maintained to preserve external references. Original Description A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescriptio...

CVE-2025-10044

A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...

CVE-2025-10043

Rejected reason: Considered by the maintainers a bug scenario experienced rather than a vulnerability...

CVE-2025-10043

...

CVE-2025-10043

...

CVE-2025-10043

CVE-2025-10043 is rejected/not used as stated; not an active vulnerability entry.

CVE-2025-10044 Keycloak: keycloak error_description injection on error pages

A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...

CVE-2025-10044 Keycloak: keycloak error_description injection on error pages

A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...

CVE-2025-10044 Keycloak: keycloak error_description injection on error pages

A flaw was found in Keycloak. Keycloak’s account console and other pages accept arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading...

CVE-2025-10044

CVE-2025-10044 affects Keycloak: error_description injection on error pages allows arbitrary text to be rendered in the UI, enabling phishing-like messages (e.g., fake support numbers/URLs) without XSS. The issue is mitigated by HTML encoding but still enables deceptive content within the trusted...