4924 matches found
GHSA-895X-RFQP-JH5C vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-27GC-WJ6X-9W55 vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2025-7784 vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-M4J5-5X4R-2XP9 vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-XHPR-465J-7P9Q vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2025-7365 vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-27GP-8389-HM4W vulnerabilities
Vulnerabilities for packages: keycloak...
Keycloak < 26.4.11 Multiple Vulnerabilities
Keycloak versions installed prior to 26.4.11 are affected by multiple vulnerabilities: - A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an...
CVE-2025-11537 vulnerabilities
Vulnerabilities for packages: keycloak...
GHSA-GV3V-2CPP-3PMQ vulnerabilities
Vulnerabilities for packages: keycloak...
CVE-2025-11537 vulnerabilities
Vulnerabilities for packages: keycloak-fips, keycloak...
GHSA-GV3V-2CPP-3PMQ vulnerabilities
Vulnerabilities for packages: keycloak-fips, keycloak...
Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing CORS header injection vulnerability in Keycloak's User-Managed Access UMA token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token JWT is used to set the...
GHSA-5V8V-XVJV-57X7 Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing CORS header injection vulnerability in Keycloak's User-Managed Access UMA token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token JWT is used to set the...
EUVD-2026-19201
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing CORS header injection vulnerability in Keycloak's User-Managed Access UMA token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token JWT is used to set the...
CVE-2026-37977
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing CORS header injection vulnerability in Keycloak's User-Managed Access UMA token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token JWT is used to set the...
CVE-2026-37977
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing CORS header injection vulnerability in Keycloak's User-Managed Access UMA token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token JWT is used to set the...
CVE-2026-37977
CVE-2026-37977 affects Keycloak’s User-Managed Access (UMA) token endpoint. A flaw in CORS handling arises when the azp claim from a client-supplied JWT is used to set the Access-Control-Allow-Origin header before JWT validation, allowing an attacker-controlled origin to be reflected in responses...
CVE-2026-37977 Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing CORS header injection vulnerability in Keycloak's User-Managed Access UMA token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token JWT is used to set the...
CVE-2026-37977 Keycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim
A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing CORS header injection vulnerability in Keycloak's User-Managed Access UMA token endpoint. This flaw occurs because the azp claim from a client-supplied JSON Web Token JWT is used to set the...