4835 matches found
PT-2025-43516
Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A logic flaw exists in Keycloak’s session management. The software does not immediately enforce the disabling of the "Remember Me" realm setting on existing user sessions. Sessions created...
Red Hat build of Keycloak 代码问题漏洞
Red Hat build of Keycloak is a web application for single sign-on from Red Hat, Inc. A code issue vulnerability exists in the Red Hat build of Keycloak, which stems from an offline session remaining active after removing the client's offlineaccess scope, which could lead to an administrator...
GHSA-25QH-J22F-PWP8 vulnerabilities
Vulnerabilities for packages: nextflow, apache-nifi, zookeeper, cassandra, akhq, kserve-modelmesh, dependency-track, management-api-for-apache-cassandra-5.0, sonar-scanner-cli, keycloak-config-cli, apache-nifi-registry, thingsboard, trino, cassandra-reaper...
CVE-2025-11226 vulnerabilities
Vulnerabilities for packages: nextflow, apache-nifi, zookeeper, cassandra, akhq, kserve-modelmesh, dependency-track, management-api-for-apache-cassandra-5.0, sonar-scanner-cli, keycloak-config-cli, apache-nifi-registry, thingsboard, trino, cassandra-reaper...
CVE-2025-11226 vulnerabilities
Vulnerabilities for packages: trino, management-api-for-apache-cassandra-5.0, apache-nifi-registry, nacos, kserve-modelmesh, kayenta-fips, keycloak-config-cli, management-api-for-apache-cassandra-4.0, cassandra-reaper, cassandra, hadoop-fips, thingsboard, ontop, zookeeper-fips,...
GHSA-25QH-J22F-PWP8 vulnerabilities
Vulnerabilities for packages: trino, management-api-for-apache-cassandra-5.0, apache-nifi-registry, nacos, kserve-modelmesh, kayenta-fips, keycloak-config-cli, management-api-for-apache-cassandra-4.0, cassandra-reaper, cassandra, hadoop-fips, thingsboard, ontop, zookeeper-fips,...
Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.10 Security Update
New Red Hat build of Keycloak 26.2.10 packages are available from the Customer Portal Red Hat build of Keycloak 26.2.10 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...
keycloak: Keycloak TLS Client-Initiated Renegotiation Denial of Service
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable...
Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.10 Images Security Update
New images are available for Red Hat build of Keycloak 26.2.10 and Red Hat build of Keycloak 26.2.10 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...
GHSA-27GC-WJ6X-9W55 Keycloak error_description injection on error pages that can trigger phishing attacks
Keycloak’s account console accepts arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages e.g., fake support phone numbers or...
EUVD-2025-27029
Keycloak errordescription injection on error pages that can trigger phishing attacks...
Keycloak error_description injection on error pages that can trigger phishing attacks
Keycloak’s account console accepts arbitrary text in the errordescription query parameter. This text is directly rendered in error pages without validation or sanitization. While HTML encoding prevents XSS, an attacker can craft URLs with misleading messages e.g., fake support phone numbers or...
Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.16 Update
New Red Hat build of Keycloak 26.0.16 packages are available from the Customer Portal Red Hat build of Keycloak 26.0.16 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications. Security...
Important: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.16 Images Update
New images are available for Red Hat build of Keycloak 26.0.16 and Red Hat build of Keycloak 26.0.16 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...
keycloak: Keycloak TLS Client-Initiated Renegotiation Denial of Service
A flaw was found in Keycloak. This vulnerability allows an unauthenticated remote attacker to cause a denial of service DoS by repeatedly initiating TLS 1.2 client-initiated renegotiation requests to exhaust server CPU resources, making the service unavailable...
Exploit for Server-Side Request Forgery in Apache Kafka
Apache Kafka 4.1.0 with Keycloak OAuth2 Authentication Produc...
EUVD-2025-25456
Keycloak Potential Variable Reference in Model Storage Services...
Keycloak Potential Variable Reference in Model Storage Services
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...
GHSA-8HXP-QMPH-W5GQ Keycloak Potential Variable Reference in Model Storage Services
A flaw was found in org.keycloak/keycloak-model-storage-service. The KeycloakRealmImport custom resource substitutes placeholders within imported realm documents, potentially referencing environment variables. This substitution process allows for injection attacks when crafted realm documents are...