Keycloak secondary factor bypass in step-up authentication

Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication...

GHSA-4F53-XH3V-G8X4 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-4F53-XH3V-G8X4 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-4F53-XH3V-G8X4 Keycloak secondary factor bypass in step-up authentication

Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication...

GHSA-MRV8-PQFJ-7GP5 vulnerabilities

Vulnerabilities for packages: keycloak...

GHSA-MRV8-PQFJ-7GP5 vulnerabilities

Vulnerabilities for packages: keycloak...

Keycloak path traversal vulnerability in the redirect validation

An issue was found in the redirecturi validation logic that allows for a bypass of otherwise explicitly allowed hosts...

GHSA-MRV8-PQFJ-7GP5 Keycloak path traversal vulnerability in the redirect validation

An issue was found in the redirecturi validation logic that allows for a bypass of otherwise explicitly allowed hosts...

CVE-2024-2419 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2024-1249 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2024-2419 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2024-2419

A flaw was found in Keycloak's redirecturi validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291...

CVE-2024-1249 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2024-1249

A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origi...

CVE-2024-1132 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2024-1132

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects a...

CVE-2024-1132

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. This issue could allow an attacker to construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This flaw affects a...

CVE-2024-1132 vulnerabilities

Vulnerabilities for packages: keycloak...

CVE-2024-2419

CVE-2024-2419 concerns Keycloak’s redirect_uri validation, enabling an open-redirect that could facilitate phishing and token theft by a remote attacker. The issue allows bypassing otherwise allowed hosts and could enable impersonation of other users via stolen access tokens. CVSS v3.1 base score...

CVE-2024-2419 Keycloak: path traversal in the redirect validation

A flaw was found in Keycloak's redirecturi validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making it possible for the attacker to impersonate other users. It is very similar to CVE-2023-6291...