org.keycloak:keycloak-dependencies-server-all (7.0.1), org.keycloak:keycloak-saml-adapter-api-public (7.0.1) +23 more potentially affected by CVE-2024-8698 via org.keycloak:keycloak-saml-core (7.0.1)

org.keycloak:keycloak-saml-core MAVEN version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 7.0.1 - org.keycloak:keycloak-saml-adapter-api-publ...

de.arbeitsagentur.opdt:keycloak-cassandra-model-tests (>=3.0.1-25.0, <=4.0.2-25.0), de.arbeitsagentur.opdt:keycloak-extension-bundid (1.0.0-25.0) +27 more potentially affected by CVE-2024-8698 via org.keycloak:keycloak-saml-core (>=25.0.0, <=25.0.5)

org.keycloak:keycloak-saml-core MAVEN version =25.0.0, =3.0.1-25.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.0, =25.0.5 - org.keycloak:keycloak-saml-jakarta-servlet-filter-adapter 25.0.3 - org.keycloak:keycloak-saml-jetty-adapter-core 25.0.3...

org.keycloak:keycloak-dependencies-server-all (10.0.1), org.keycloak:keycloak-saml-adapter-api-public (10.0.1) +23 more potentially affected by CVE-2024-8698 via org.keycloak:keycloak-saml-core (10.0.1)

org.keycloak:keycloak-saml-core MAVEN version 10.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 10.0.1 -...

com.github.wnameless.spring.boot.up:spring-boot-up-embedded-keycloak (24.3.0.0), com.github.wnameless.spring.boot.up:spring-boot-up-keycloak-plugin (24.3.0.0) +28 more potentially affected by CVE-2024-8698 via org.keycloak:keycloak-saml-core (>=23.0.0, <=24.0.5)

org.keycloak:keycloak-saml-core MAVEN version =23.0.0, =2.5.6-24.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =23.0.0, =24.0.5 and more Source cves: CVE-2024-8698 Source advisory: OSV:GHSA-XGFV-XPX8-QHCR...

org.keycloak:keycloak-dependencies-server-all (2.1.0.final), org.keycloak:keycloak-saml-adapter-api-public (2.1.0.final) +21 more potentially affected by CVE-2024-8698 via org.keycloak:keycloak-saml-core (2.1.0.final)

org.keycloak:keycloak-saml-core MAVEN version 2.1.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 2.1.0.final -...

org.keycloak:keycloak-dependencies-server-all (3.4.0.final), org.keycloak:keycloak-saml-adapter-api-public (3.4.0.final) +26 more potentially affected by CVE-2024-8698 via org.keycloak:keycloak-saml-core (3.4.0.final)

org.keycloak:keycloak-saml-core MAVEN version 3.4.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 3.4.0.final -...

org.keycloak:keycloak-dependencies-server-all (2.0.0.final), org.keycloak:keycloak-saml-adapter-api-public (2.0.0.final) +19 more potentially affected by CVE-2024-8698 via org.keycloak:keycloak-saml-core (2.0.0.final)

org.keycloak:keycloak-saml-core MAVEN version 2.0.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.keycloak:keycloak-saml-core and may be impacted: - org.keycloak:keycloak-dependencies-server-all 2.0.0.final -...

GHSA-J76J-RQWJ-JMVV Duplicate Advisory: Keycloak Session Fixation vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5rxp-2rhr-qwqv. This link is maintained to preserve external references. Original Description A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cook...

PT-2024-38275

Name of the Vulnerable Software and Affected Versions Keycloak SAML adapters affected versions not specified Description A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the...

org.keycloak:keycloak-saml-wildfly-subsystem (>=3.3.0.cr1, <=3.4.0.final), org.keycloak:keycloak-wildfly-server-subsystem (>=3.3.0.cr1, <=3.4.0.final) +51 more potentially affected by CVE-2021-3644 via org.wildfly.core:wildfly-server (3.0.1.final)

org.wildfly.core:wildfly-server MAVEN version 3.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.wildfly.core:wildfly-server and may be impacted: - org.keycloak:keycloak-saml-wildfly-subsystem =3.3.0.cr1, =3.3.0.cr1, =3.3.0.cr1, =3.4.0.fin...

Information Disclosure

keycloak-saml-core is vulnerable to sensitive information disclosure. The attack exists because SAML messages are being parsed by replacing the string to obtain the attribute values with the system property in StaxParserUtil class. Therefore, attacker can just parse the chosen system property nam...