Cross-site Request Forgery

keycloak-services is vulnerable to cross-site request forgery CSRF attacks. The earlier versions of keycloak-services did not include CSRF protection mechanisms, thus allowing attackers with valid session cookies to perform CSRF attacks...

CVE-2014-3652

JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL...

CVE-2014-3656

JBoss KeyCloak: XSS in login-status-iframe.html...

CVE-2014-3655

JBoss KeyCloak is vulnerable to soft token deletion via CSRF...