4603 matches found
GHSA-46C8-635V-68R2 vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-8RMM-GM28-PJ8Q vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-8RMM-GM28-PJ8Q Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow
Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL ACS, including JavaScript URIs javascript:. Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission. Acknowledgements: Specia...
GHSA-8RMM-GM28-PJ8Q vulnerabilities
Vulnerabilities for packages: keycloak...
Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow
Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL ACS, including JavaScript URIs javascript:. Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission. Acknowledgements: Specia...
GHSA-4F53-XH3V-G8X4 vulnerabilities
Vulnerabilities for packages: keycloak...
Keycloak secondary factor bypass in step-up authentication
Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication...
GHSA-4F53-XH3V-G8X4 vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-4F53-XH3V-G8X4 Keycloak secondary factor bypass in step-up authentication
Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication...
GHSA-MRV8-PQFJ-7GP5 Keycloak path traversal vulnerability in the redirect validation
An issue was found in the redirecturi validation logic that allows for a bypass of otherwise explicitly allowed hosts...
GHSA-MRV8-PQFJ-7GP5 vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-MRV8-PQFJ-7GP5 vulnerabilities
Vulnerabilities for packages: keycloak...
Keycloak path traversal vulnerability in the redirect validation
An issue was found in the redirecturi validation logic that allows for a bypass of otherwise explicitly allowed hosts...
CVE-2024-2419 vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2024-1249 vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2024-2419 vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2024-2419
A flaw was found in Keycloak's redirecturi validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291...
CVE-2024-1249
A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origi...