4601 matches found
CVE-2025-1391
CVE-2025-1391 : The issue is an improper authorization in the Keycloak organization mapper, where a user can be misrepresented as belonging to an organization in tokens if their username or email matches the organization’s domain pattern. The flaw is confined to token claims and does not imply tr...
CVE-2025-1391 Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...
CVE-2025-1391 Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...
CVE-2025-1391 Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...
MAL-2025-1386 Malicious code in keycloak-theme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa8e4f6226555a04c5be8dab42fe39f502765a1bd0dad057b6e8c057939e5dad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in keycloak-theme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa8e4f6226555a04c5be8dab42fe39f502765a1bd0dad057b6e8c057939e5dad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-1391
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies o...
Keycloak 访问控制错误漏洞
Keycloak is an open source identity and access management solution from Keycloak Open Source. Keycloak suffers from an access control error vulnerability that stems from a user-organization domain pattern mismatch in the organization function. An attacker exploiting this vulnerability could be...
GHSA-PHG3-GV66-Q38X vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-PHG3-GV66-Q38X vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2025-1247 vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2025-1247 vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2025-24970 vulnerabilities
Vulnerabilities for packages: tez, management-api-for-apache-cassandra-5.0, wildfly, cloudwatch-exporter, trino, flyway, logstash, apache-nifi, selenium, thingsboard, opensearch, apicurio-registry, celeborn, docker-selenium, apache-activemq-artemis, druid, keycloak, cassandra-reaper,...
CVE-2025-25193 vulnerabilities
Vulnerabilities for packages: keycloak, wildfly, celeborn...
CVE-2025-25193 vulnerabilities
Vulnerabilities for packages: celeborn, wildfly, knative-kafka-broker, keycloak, seata, zookeeper-fips...
GHSA-389X-839F-4RHX vulnerabilities
Vulnerabilities for packages: keycloak, wildfly, celeborn...
GHSA-389X-839F-4RHX vulnerabilities
Vulnerabilities for packages: celeborn, wildfly, knative-kafka-broker, keycloak, seata, zookeeper-fips...
GHSA-4G8C-WM8X-JFHW vulnerabilities
Vulnerabilities for packages: tez, management-api-for-apache-cassandra-5.0, wildfly, cloudwatch-exporter, trino, flyway, logstash, apache-nifi, selenium, thingsboard, opensearch, apicurio-registry, celeborn, docker-selenium, apache-activemq-artemis, druid, keycloak, cassandra-reaper,...
GHSA-G6QQ-C9F9-2772 Keycloak on Quarkus CLI option for encrypted JGroups ignored
The env option KCCACHEEMBEDDEDMTLSENABLED does not work and the jgroups replication configuration is always used in plain. This option worked before in 24 and 22. More info in public issue https://github.com/keycloak/keycloak/issues/34644...
Keycloak on Quarkus CLI option for encrypted JGroups ignored
The env option KCCACHEEMBEDDEDMTLSENABLED does not work and the jgroups replication configuration is always used in plain. This option worked before in 24 and 22. More info in public issue https://github.com/keycloak/keycloak/issues/34644...