CVE-2022-4137

CVE-2022-4137 is a reflected XSS in Keycloak’s oob OAuth endpoint caused by incorrect null-byte handling. A malicious link can insert an arbitrary URI into a Keycloak error page, and exploitation requires user interaction, potentially compromising user details. Connected sources identify this vul...

CVE-2023-48795

CVE-2023-48795 is referenced across several connected advisories, detailing affected packages and required upgrades. Astra Linux/CBL-Mariner entries note: podman (<5.6.1-2) needs upgrade, erlang (<25.2-1), libssh2 (<1.11.1-1), libssh (<0.10.6-1), terraform (<1.3.2-25), kubevirt (&l...

CVE-2022-1438

CVE-2022-1438 is an XSS vulnerability in Keycloak where HTML entities are not sanitized during user impersonation. Red Hat advisories (RHSA-2023:1043/1044/1045) fix this issue in Red Hat Single Sign-On 7.6.2 on RHEL 7/8/9. The NVD CVSS data indicates a MEDIUM to HIGH impact depending on the vecto...

CVE-2021-3827

CVE-2021-3827 concerns Keycloak where the default ECP binding flow can bypass other authentication flows, enabling an attacker to bypass MFA by sending a SOAP AuthnRequest with an Authorization header containing user credentials. Exploitation affects confidentiality and integrity as described in ...

CVE-2024-1132

Keycloak path traversal vulnerability (CVE-2024-1132) arises from improper validation of redirect URLs, enabling an attacker to bypass validation and access other URLs within the domain when a client uses wildcard Valid Redirect URIs. The issue requires user interaction and affects clients with w...

CVE-2023-6927

CVE-2023-6927 describes a Keycloak flaw where an attacker could steal authorization codes or tokens from clients that use a wildcard in the JARM response mode "form_post.jwt", potentially bypassing the security patch for CVE-2023-6134. The metric indicates a MEDIUM severity (CVSS v3.1 base score ...

CVE-2023-6787

Keycloak is affected by CVE-2023-6787 due to an error in the re-authentication flow (org.keycloak.authentication). Triggering a new authentication with prompt=login can hijack an active session, because if the user cancels via Restart login, a new session with a different SUB may end up sharing t...

CVE-2022-3782

CVE-2022-3782 affects Keycloak / Red Hat Single Sign-On: path traversal via double URL encoding due to improper validation of redirect URLs, enabling an attacker to traverse to arbitrary files within the domain when wildcard Redirect URIs are used. Connected sources confirm the issue and indicate...

CVE-2024-7341

CVE-2024-7341 describes a session fixation flaw in Keycloak’s SAML adapters (Elytron SAML) where the session ID and JSESSIONID cookie are not rotated on login, even with turnOffChangeSessionIdOnLogin enabled. This allows an attacker who hijacks the current session before authentication to trigger...

CVE-2022-3916

CVE-2022-3916 affects Keycloak via the offline_access scope. The flaw arises from missing root-session validation and reuse of session IDs between root and user authentication sessions, enabling an attacker to resolve a user session attached to a previously authenticated user; using the refresh t...

CVE-2023-0264

CVE-2023-0264 concerns an improper authentication flaw in Keycloak’s OpenID Connect user authentication, potentially allowing impersonation and new session token generation. The connected documents include a GitHub PoC (Exploit for Improper Authentication in Redhat Keycloak) describing a session ...

CVE-2024-7260

Keycloak contains CVE-2024-7260, an open redirect vulnerability. A specially crafted URL using referrer and referrer_uri can mislead users (including admins) into visiting a malicious site, potentially enabling phishing or other attacks. The vulnerability is triggered when the crafted URL is visi...

CVE-2020-10770

CVE-2020-10770 describes a Server-Side Request Forgery (SSRF) in OpenID Connect Issuer handling of the request_uri parameter in Keycloak before 13.0.0, allowing an attacker to cause the server to fetch an unverified URL. The vulnerability is backed by multiple sources within the connected documen...

CVE-2023-6841

Keycloak Denial of Service (CVE-2023-6841) is triggered by unbounded attributes per object; a remote attacker can exhaust resources by sending crafted HTTP requests, causing DoS. Public details describe impact as availability loss with high CVSS, and remediation guidance points to upgrading to Ke...

CVE-2023-6291

Technical details about CVE-2023-6291 are not publicly available in the provided documents. Monitor for updates from Red Hat/Keycloak advisories for affected products, versions, and patches.

CVE-2022-1274

CVE-2022-1274 is referenced in Red Hat advisories RHSA-2023-1043/1044 as a fix for Red Hat Single Sign-On 7.6.2 on RHEL 7/8/9. The vulnerability is linked to Keycloak’s execute-actions-email flow, with the cited issue being a missing email notification template allowlist that can enable an XSS-li...

CVE-2023-6134

CVE-2023-6134 is a vulnerability in Keycloak-based Red Hat Single Sign-On (SSO) implementations, disclosed by OSV entries tied to RHSA advisories. The issue is a reflected XSS via a wildcard in the OIDC redirect_uri, arising from an incomplete fix for CVE-2020-10748. The connected docs confirm th...

CVE-2021-20323

Keycloak 10.0.0–18.0.0 contains a post-based reflected XSS via the client-registrations endpoint. The root cause is that a JSON key value is echoed in an error response with Content-Type: text/html, enabling HTML/JS execution in the user’s browser when a POST is used. Impact includes potential ar...

CVE-2022-1245

CVE-2022-1245 affects Keycloak-based Red Hat Single Sign-On (RH SSO) 7.5.x. The flaw enables privilege escalation via the token-exchange feature where a client with a valid access token can exchange tokens for any target client by supplying its client_id, potentially gaining unauthorized access t...

CVE-2023-0091

CVE-2023-0091 is linked to Red Hat/SO, affecting Red Hat Single Sign-On (based on Keycloak). Description from RH advisories: the issue is that the Client Registration endpoint does not check token revocation in the client credential flow, enabling potential unauthorized access or modification of ...

CVE-2023-2422

CVE-2023-2422 describes an authentication flaw in Keycloak-based deployments where mTLS client certificate chain verification is insufficient. The vulnerability allows a client with a valid certificate to impersonate another client and access data belonging to that client. The issue is documented...

CVE-2021-20195

Summary (CVE-2021-20195) : A Self Stored XSS in Keycloak prior to 13.0.0 allows an attacker to escalate to account takeover by abusing unencoded user-supplied fields processed by JavaScript. Reported impact includes potential compromise of data confidentiality, integrity, and system availability....

CVE-2023-6563

CVE-2023-6563 is an offline-session DoS vulnerability in Keycloak/Red Hat SSO. Exploitation arises when an attacker triggers the admin UI by opening the consents tab after creating multiple user sessions, causing massive offline session load and resource exhaustion. The issue is acknowledged in R...

CVE-2021-4133

Keycloak vulnerability CVE-2021-4133 affects versions 12.0.0 up to, but not including, 15.1.1. An attacker with an existing user account can create new default user accounts via the administrative REST API even when new user registration is disabled, due to improper authorization validation in th...

CVE-2020-1758

CVE-2020-1758 affects Keycloak versions before 10.0.0. The issue is that TLS hostname verification is not performed when Keycloak sends emails via an SMTP server, which can allow a man‑in‑the‑middle (MITM) attack. The connected sources consistently describe this flaw and its mitigation; there are...

CVE-2020-27826

The CVE-2020-27826 entry concerns Keycloak prior to 12.0.0, where a flaw in the Account REST API allows updating a user’s metadata attributes, specifically the NameID, enabling an attacker to impersonate the admin user for a given application. The affected component is Keycloak’s account metadata...

CVE-2020-1714

Keycloak before 11.0.0 contains usages of ObjectInputStream without type checks, allowing deserialization of arbitrary Java objects in a privileged context and potentially enabling remote code execution (CVE-2020-1714). References associate this CVE with Red Hat advisories noting Keycloak as the ...

CVE-2023-1664

Keycloak (X509 Client Certificate Auth with Revalidate Client Certificate) is affected when KC_SPI_TRUSTSTORE_FILE_FILE is misconfigured; a attacker can craft a certificate to be trusted and obtain sensitive information. The IBM bulletin lists Keycloak vulnerability CVE-2023-1664 with a base scor...

CVE-2023-0105

CVE-2023-0105 affects Keycloak: the vulnerability stems from incorrect handling of email trust, enabling an attacker to shadow other users with the same email and cause impersonation or lockout. The issue is documented in multiple sources (GHSA and OSV) with explicit description of impersonation/...

CVE-2022-4361

CVE-2022-4361 affects Keycloak’s SAML and OIDC providers, with a cross-site scripting (XSS) vulnerability that can be triggered by setting the AssertionConsumerServiceURL value or the redirect_uri. The connected sources consistently describe XSS in the SAML/OIDC flows and the ability to cause mal...

CVE-2020-1744

CVE-2020-1744 – Keycloak before 9.0.1: A flaw in configuring a Conditional OTP Authentication Flow as a post-login flow causes failure login events for OTP not to be sent to the brute force protection event queue, so BruteForceProtector does not handle these events. Affected product: Keycloak (ve...

CVE-2022-0225

CVE-2022-0225 is a stored XSS vulnerability in Keycloak where a privileged attacker can inject script via the group name during admin console group creation. The NVD entry (CVSS v3.1 base 5.4) notes network access with low privileges and user interaction required. Supporting documents provide con...

CVE-2022-1466

CVE-2022-1466 affects Red Hat Single Sign-On (Keycloak-based) where improper authorization allows an authenticated user to perform actions beyond permissions, specifically adding users to the master realm. Root cause: insufficient authorization checks for master-realm actions. Impact: potential u...

CVE-2017-2582

Technical details for CVE-2017-2582 are not publicly available in the provided documents. Monitor for updates as new information becomes available.

CVE-2020-1697

CVE-2020-1697 affects Keycloak versions before 9.0.0 where admin console links to external applications (Application Links) are not validated, allowing an authenticated user to craft links that trigger Stored XSS cross-realm. The issue is evidenced in multiple feeds (Red Hat advisories explicitly...

CVE-2020-14389

Keycloak CVE-2020-14389 affects Keycloak prior to 12.0.0. A user with only the view-profile role could manage resources in the New Account Console, enabling access and modification of data the user should not have. The root cause is an elevation of privilege enabling restricted users to perform a...

CVE-2021-3513

CVE-2021-3513 affects Keycloak/Red Hat Single Sign-On; root cause is a wrong error message during credential entry that enables brute-force attempts even with permanent lockout. Impact is confidentiality. Connected docs confirm the issue and reference security advisories, but do not provide expli...

CVE-2019-3875

Keycloak prior to 6.0.2 is affected by CVE-2019-3875 due to missing signatures validation on CRLs used for client-certificate verification. This can enable MITM-style attacks via CRLs obtained over untrusted networks (CDP/HTTP/LDAP). Red Hat’s advisory RHSA-2020:2366 flags this as a security fix,...

CVE-2024-4629

The CVE-2024-4629 issue is a brute-force protection bypass in Keycloak/Red Hat Single Sign-On 7.6.10 (and related builds). A timing-based flaw lets parallel login attempts exceed configured failed-attempt limits before lockout, enabling more password guesses. Red Hat has patched this in RHSA advi...

CVE-2019-10201

Keycloak SAML broker (versions up to 6.0.1) is affected by CVE-2019-10201. The issue is that the broker did not verify the existence of signatures on SAML responses, so an attacker could modify a SAML Response (e.g., remove elements) and still have it accepted, enabling impersonation and access ...

CVE-2024-1722

CVE-2024-1722 describes a Denial of Service condition in Keycloak where, under certain conditions, an unauthenticated remote attacker could block other accounts from logging in. The connected advisories (GHSA-CQ42-VHV7-XR7P and OSV/GHSA mirrors) specify this as a DoS via account lockout, with a c...

CVE-2018-14637

The vulnerability CVE-2018-14637 affects Keycloak prior to 4.6.0.Final, where the SAML broker consumer endpoint ignores expiration checks on SAML assertions. This enables replay attacks against requests authenticated via SAML assertions. Connected advisories (GHSA-GF2J-7QWG-4F5X and related OSV/C...

CVE-2020-10748

Keycloak data filter flaw in version 10.0.1 could process data URLs in certain conditions, enabling cross-site scripting and potentially aiding further attacks. The issue is linked to an incomplete fix for CVE-2020-10748 and is discussed in related advisories describing reflected XSS via redirect...

CVE-2020-1718

CVE-2020-1718 affects Keycloak: a flaw in the reset credential flow in all Keycloak versions before 8.0.0 allows an attacker to gain unauthorized access to the application. This is corroborated by the GHSA entry describing the same issue. Exploitation status and remediation details are not provid...

CVE-2019-3868

CVE-2019-3868 affects Keycloak up to v6.0.0, enabling the end-user token (access/id token) to be used as the browser session cookie for OIDC, allowing session hijacking if an attacker can access the service provider backend. Red Hat advisories list this as a featured fix under Red Hat Single Sign...

CVE-2020-10776

Keycloak vulnerability CVE-2020-10776 affects Keycloak up to version 12.0.0, where the redirect_uri parameter could accept unsafe schemes, enabling Cross-site Scripting (XSS). Evidence across multiple sources confirms the flaw and its association with Keycloak prior to 12.0.0 (GHSA-484Q-784P-8M5H...

CVE-2019-10170

CVE-2019-10170 (Keycloak) concerns a flaw in the Keycloak admin console where the realm management interface permits configuring a script via policy. An attacker who already has an authenticated user and realm management permissions can configure a malicious script to trigger and execute arbitrar...

CVE-2019-14820

In Keycloak, versions before 8.0.0 expose internal adapter endpoints via org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This could allow an attacker to access unauthorized information. Affected: Keycloak

CVE-2022-2668

CVE-2022-2668 affects Red Hat Single Sign-On (Keycloak-based) where uploading SAML Javascript via the admin console allows arbitrary Javascript. Root cause: SAML protocol mapper scripts could be uploaded even with UPLOAD_SCRIPTS disabled. Impact per sources is high (CVE-3.1 score 7.2, Confidentia...

CVE-2021-3637

CVE-2021-3637 affects Rational Test Automation Server (Keycloak-based) prior to v10.5 integration, due to a flaw in the keycloak-model-infinispan function. The vulnerability allows the authenticationSessions map in RootAuthenticationSessionEntity to grow boundlessly when a specially crafted reque...