be.jidoka:jdk-keycloak-admin (>=1.2.0 <=2.4.0), br.com.anteros:Anteros-Keycloak (=1.0.0) +1133 more potentially affected by CVE-2024-4028 via org.keycloak:keycloak-core (>=10.0.0 <=26.1.2)

org.keycloak:keycloak-core MAVEN version =10.0.0, =1.2.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.10.0, =0.10.0, =0.10.5-experimental and more Source cves: CVE-2024-4028 Source advisory: OSV:GHSA-Q4XQ-445G-G6CH...

be.jidoka:jdk-keycloak-admin (>=1.2.0 <=2.4.0), br.com.anteros:Anteros-Keycloak (=1.0.0) +1097 more potentially affected by CVE-2024-10039 via org.keycloak:keycloak-core (>=10.0.0 <=26.0.5)

org.keycloak:keycloak-core MAVEN version =10.0.0, =1.2.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.0, =0.1.0, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.10.0, =0.10.0, =0.10.5-experimental and more Source cves: CVE-2024-10039 Source advisory: OSV:GHSA-93WW-43RR-79V3...

keycloak-core: mTLS passthrough

A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication...

be.jidoka:jdk-keycloak-admin (>=1.2.0 <=2.3.0), br.com.anteros:Anteros-Keycloak (=1.0.0) +1061 more potentially affected by CVE-2024-7318 via org.keycloak:keycloak-core (>=10.0.0 <=24.0.5)

org.keycloak:keycloak-core MAVEN version =10.0.0, =1.2.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.10.0, =0.10.0, =0.5.0, =0.10.5-experimental and more Source cves: CVE-2024-7318 Source advisory: OSV:GHSA-XMMM-JW76-Q7VG...

be.jidoka:jdk-keycloak-admin (>=1.2.0 <=2.3.0), br.com.anteros:Anteros-Keycloak (=1.0.0) +1033 more potentially affected by CVE-2023-6841 via org.keycloak:keycloak-core (>=10.0.0 <=23.0.7)

org.keycloak:keycloak-core MAVEN version =10.0.0, =1.2.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.10.0, =0.10.0, =0.5.0, =0.10.5-experimental and more Source cves: CVE-2023-6841 Source advisory: OSV:GHSA-W97F-W3HQ-36G2...

be.jidoka:jdk-keycloak-admin (>=1.2.0 <=2.3.0), br.com.anteros:Anteros-Keycloak (=1.0.0) +1061 more potentially affected by CVE-2024-7260 via org.keycloak:keycloak-core (>=10.0.0 <=24.0.5)

org.keycloak:keycloak-core MAVEN version =10.0.0, =1.2.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.10.0, =0.10.0, =0.5.0, =0.10.5-experimental and more Source cves: CVE-2024-7260 Source advisory: OSV:GHSA-G4GC-RH26-M3P5...

keycloak-core: Open Redirect on Account page

An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referreruri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it...

Credential Leakage

org.keycloak, keycloak-core is vulnerable to Credential Leakage. The vulnerability is due to a lack of proper validation and enforcement when administrators change the LDAP Connection URL without requiring re-entry of the currently configured LDAP bind credentials. The vulnerability allows an...

be.jidoka:jdk-keycloak-admin (>=1.2.0 <=2.3.0), br.com.anteros:Anteros-Keycloak (=1.0.0) +1011 more potentially affected by CVE-2023-6927 via org.keycloak:keycloak-core (>=10.0.0 <=23.0.3)

org.keycloak:keycloak-core MAVEN version =10.0.0, =1.2.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.10.0, =0.10.0, =0.5.0, =0.10.5-experimental and more Source cves: CVE-2023-6927 Source advisory: OSV:GHSA-9VM7-V8WJ-3FQW...

GHSA-9VM7-V8WJ-3FQW keycloak-core: open redirect via "form_post.jwt" JARM response mode

An incomplete fix was found in Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt". It is observed that changing the responsemode parameter in the original proof of concept from "formpost" to "formpost.jwt...

CVE-2023-6920

An incomplete fix was found in the Keycloak Core patch. An attacker can steal authorization codes or tokens from clients using a wildcard in the JARM response mode "formpost.jwt". Changing the responsemode parameter in the original proof of concept from "formpost" to "formpost.jwt" can bypass the...

be.jidoka:jdk-keycloak-admin (>=1.2.0 <=2.2.0), br.com.anteros:Anteros-Keycloak (=1.0.0) +904 more potentially affected by CVE-2023-0105 via org.keycloak:keycloak-core (>=10.0.0 <=22.0.0)

org.keycloak:keycloak-core MAVEN version =10.0.0, =1.2.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.10.0, =0.10.0, =0.5.0, =0.10.5-experimental and more Source cves: CVE-2023-0105 Source advisory: OSV:GHSA-C7XW-P58W-H6FJ...

be.jidoka:jdk-keycloak-admin (>=1.2.0 <=2.2.0), br.com.anteros:Anteros-Keycloak (=1.0.0) +897 more potentially affected by CVE-2023-1664 via org.keycloak:keycloak-core (>=10.0.0 <=21.1.1)

org.keycloak:keycloak-core MAVEN version =10.0.0, =1.2.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.10.0, =0.10.0, =0.5.0, =0.10.5-experimental and more Source cves: CVE-2023-1664 Source advisory: OSV:GHSA-5CC8-PGP5-7MPM...

be.jidoka:jdk-keycloak-admin (>=1.2.0 <=1.3.0), br.com.anteros:Anteros-Keycloak (=1.0.0) +846 more potentially affected by CVE-2023-0091 via org.keycloak:keycloak-core (>=10.0.0 <=20.0.2)

org.keycloak:keycloak-core MAVEN version =10.0.0, =1.2.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.10.0, =0.10.0, =0.5.0, =0.10.5-experimental and more Source cves: CVE-2023-0091 Source advisory: OSV:GHSA-V436-Q368-HVGG...

be.jidoka:jdk-keycloak-admin (=1.2.0), ca.bc.gov.tno:dal-db (>=0.0.8-alpha <=0.0.17-alpha) +383 more potentially affected by CVE-2021-3632 via org.keycloak:keycloak-core (>=10.0.0 <=15.0.2)

org.keycloak:keycloak-core MAVEN version =10.0.0, =0.0.8-alpha, =0.0.1-alpha, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.7.0, =0.7.0, =0.7.0, =0.8.2 and more Source cves: CVE-2021-3632 Source advisory: OSV:GHSA-QPQ9-JPV4-6GWR...

be.jidoka:jdk-keycloak-admin (=1.2.0), ca.bc.gov.tno:dal-db (>=0.0.8-alpha <=0.0.17-alpha) +383 more potentially affected by CVE-2021-3856 via org.keycloak:keycloak-core (>=10.0.0 <=15.0.2)

org.keycloak:keycloak-core MAVEN version =10.0.0, =0.0.8-alpha, =0.0.1-alpha, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.7.0, =0.7.0, =0.7.0, =0.8.2 and more Source cves: CVE-2021-3856 Source advisory: OSV:GHSA-3W4V-RVC4-2XPW...

be.jidoka:jdk-keycloak-admin (=1.2.0), ca.bc.gov.tno:dal-db (>=0.0.8-alpha <=0.0.17-alpha) +405 more potentially affected by CVE-2022-0225 via org.keycloak:keycloak-core (>=10.0.0 <=16.1.0)

org.keycloak:keycloak-core MAVEN version =10.0.0, =0.0.8-alpha, =0.0.1-alpha, =1.0.0, =0.2.0, =0.2.0, =0.2.0, =0.5.0, =0.2.0, =0.2.0, =0.5.0, =0.5.0, =0.5.0, =0.7.0, =0.7.0, =0.8.2 and more Source cves: CVE-2022-0225 Source advisory: OSV:GHSA-FQC7-5XXC-PH7R...

ca.bc.gov.tno:dal-db (=0.0.8-alpha), com.avast.grpc.jwt:grpc-java-jwt-keycloak (>=0.4.10 <=0.4.12) +279 more potentially affected by CVE-2020-35509 via org.keycloak:keycloak-core (>=10.0.0 <=13.0.1)

org.keycloak:keycloak-core MAVEN version =10.0.0, =0.4.10, =11.0.1, =1.2.6, =1.2.5, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.3.7 and more Source cves: CVE-2020-35509 Source advisory: OSV:GHSA-RPJ2-W6FR-79HC...

com.avast.grpc.jwt:grpc-java-jwt-keycloak (>=0.4.10 <=0.4.11), com.avast.grpc.jwt:keycloak (=0.4.9) +249 more potentially affected by CVE-2020-27838 via org.keycloak:keycloak-core (>=10.0.0 <=12.0.4)

org.keycloak:keycloak-core MAVEN version =10.0.0, =0.4.10, =11.0.1, =1.2.6, =1.2.5, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =5.0.0, =5.0.0, =5.1.0 and more Source cves: CVE-2020-27838 Source advisory: OSV:GHSA-PCV5-M2WH-66J3...

com.avast.grpc.jwt:grpc-java-jwt-keycloak (>=0.4.10 <=0.4.11), com.avast.grpc.jwt:keycloak (=0.4.9) +249 more potentially affected by CVE-2020-10770 via org.keycloak:keycloak-core (>=10.0.0 <=12.0.4)

org.keycloak:keycloak-core MAVEN version =10.0.0, =0.4.10, =11.0.1, =1.2.6, =1.2.5, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =1.2.4, =5.0.0, =5.0.0, =5.1.0 and more Source cves: CVE-2020-10770 Source advisory: OSV:GHSA-JH7Q-5MWF-QVHW...