GHSA-7FPJ-9HR8-28VH vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-7FPJ-9HR8-28VH Keycloak vulnerable to impersonation via logout token exchange

Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...

Keycloak vulnerable to impersonation via logout token exchange

Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions...

GHSA-7FPJ-9HR8-28VH vulnerabilities

Vulnerabilities for packages: keycloak...

Keycloak vulnerable to session hijacking via re-authentication

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication having the query parameter prompt=login and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover...

GHSA-C9H6-V78W-52WJ Keycloak vulnerable to session hijacking via re-authentication

A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication having the query parameter prompt=login and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover...

GHSA-C9H6-V78W-52WJ vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-72VP-XFRC-42XM vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-72VP-XFRC-42XM vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-72VP-XFRC-42XM Keycloak path traversal vulnerability in redirection validation

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

Keycloak path traversal vulnerability in redirection validation

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. Thi...

GHSA-M6Q9-P373-G5Q8 vulnerabilities

Vulnerabilities for packages: keycloak...

Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's...

GHSA-M6Q9-P373-G5Q8 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-M6Q9-P373-G5Q8 Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's...

GHSA-J628-Q885-8GR5 Keycloak vulnerable to log Injection during WebAuthn authentication or registration

A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" WebAuthn are written into the form, send to Keycloak and logged without escaping allowing log injection. Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping ...

Keycloak vulnerable to log Injection during WebAuthn authentication or registration

A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" WebAuthn are written into the form, send to Keycloak and logged without escaping allowing log injection. Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping ...

GHSA-46C8-635V-68R2 vulnerabilities

Vulnerabilities for packages: keycloak...

Keycloak Authorization Bypass vulnerability

Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration...

GHSA-46C8-635V-68R2 Keycloak Authorization Bypass vulnerability

Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration...