CVE-2021-3827

CVE-2021-3827 concerns Keycloak where the default ECP binding flow can bypass other authentication flows, enabling an attacker to bypass MFA by sending a SOAP AuthnRequest with an Authorization header containing user credentials. Exploitation affects confidentiality and integrity as described in ...

CVE-2023-6787

Keycloak is affected by CVE-2023-6787 due to an error in the re-authentication flow (org.keycloak.authentication). Triggering a new authentication with prompt=login can hijack an active session, because if the user cancels via Restart login, a new session with a different SUB may end up sharing t...

CVE-2022-3916

CVE-2022-3916 affects Keycloak via the offline_access scope. The flaw arises from missing root-session validation and reuse of session IDs between root and user authentication sessions, enabling an attacker to resolve a user session attached to a previously authenticated user; using the refresh t...

CVE-2023-0264

CVE-2023-0264 concerns an improper authentication flaw in Keycloak’s OpenID Connect user authentication, potentially allowing impersonation and new session token generation. The connected documents include a GitHub PoC (Exploit for Improper Authentication in Redhat Keycloak) describing a session ...

CVE-2024-7260

Keycloak contains CVE-2024-7260, an open redirect vulnerability. A specially crafted URL using referrer and referrer_uri can mislead users (including admins) into visiting a malicious site, potentially enabling phishing or other attacks. The vulnerability is triggered when the crafted URL is visi...

CVE-2020-10770

CVE-2020-10770 describes a Server-Side Request Forgery (SSRF) in OpenID Connect Issuer handling of the request_uri parameter in Keycloak before 13.0.0, allowing an attacker to cause the server to fetch an unverified URL. The vulnerability is backed by multiple sources within the connected documen...

CVE-2023-6291

Technical details about CVE-2023-6291 are not publicly available in the provided documents. Monitor for updates from Red Hat/Keycloak advisories for affected products, versions, and patches.

CVE-2022-1274

CVE-2022-1274 is referenced in Red Hat advisories RHSA-2023-1043/1044 as a fix for Red Hat Single Sign-On 7.6.2 on RHEL 7/8/9. The vulnerability is linked to Keycloak’s execute-actions-email flow, with the cited issue being a missing email notification template allowlist that can enable an XSS-li...

CVE-2023-6134

CVE-2023-6134 is a vulnerability in Keycloak-based Red Hat Single Sign-On (SSO) implementations, disclosed by OSV entries tied to RHSA advisories. The issue is a reflected XSS via a wildcard in the OIDC redirect_uri, arising from an incomplete fix for CVE-2020-10748. The connected docs confirm th...

CVE-2021-20323

Keycloak 10.0.0–18.0.0 contains a post-based reflected XSS via the client-registrations endpoint. The root cause is that a JSON key value is echoed in an error response with Content-Type: text/html, enabling HTML/JS execution in the user’s browser when a POST is used. Impact includes potential ar...

CVE-2022-1245

CVE-2022-1245 affects Keycloak-based Red Hat Single Sign-On (RH SSO) 7.5.x. The flaw enables privilege escalation via the token-exchange feature where a client with a valid access token can exchange tokens for any target client by supplying its client_id, potentially gaining unauthorized access t...

CVE-2023-6563

CVE-2023-6563 is an offline-session DoS vulnerability in Keycloak/Red Hat SSO. Exploitation arises when an attacker triggers the admin UI by opening the consents tab after creating multiple user sessions, causing massive offline session load and resource exhaustion. The issue is acknowledged in R...

CVE-2021-20195

Summary (CVE-2021-20195) : A Self Stored XSS in Keycloak prior to 13.0.0 allows an attacker to escalate to account takeover by abusing unencoded user-supplied fields processed by JavaScript. Reported impact includes potential compromise of data confidentiality, integrity, and system availability....

CVE-2020-1758

CVE-2020-1758 affects Keycloak versions before 10.0.0. The issue is that TLS hostname verification is not performed when Keycloak sends emails via an SMTP server, which can allow a man‑in‑the‑middle (MITM) attack. The connected sources consistently describe this flaw and its mitigation; there are...

CVE-2020-1714

Keycloak before 11.0.0 contains usages of ObjectInputStream without type checks, allowing deserialization of arbitrary Java objects in a privileged context and potentially enabling remote code execution (CVE-2020-1714). References associate this CVE with Red Hat advisories noting Keycloak as the ...

CVE-2020-27826

The CVE-2020-27826 entry concerns Keycloak prior to 12.0.0, where a flaw in the Account REST API allows updating a user’s metadata attributes, specifically the NameID, enabling an attacker to impersonate the admin user for a given application. The affected component is Keycloak’s account metadata...

CVE-2022-4361

CVE-2022-4361 affects Keycloak’s SAML and OIDC providers, with a cross-site scripting (XSS) vulnerability that can be triggered by setting the AssertionConsumerServiceURL value or the redirect_uri. The connected sources consistently describe XSS in the SAML/OIDC flows and the ability to cause mal...

CVE-2020-1744

CVE-2020-1744 – Keycloak before 9.0.1: A flaw in configuring a Conditional OTP Authentication Flow as a post-login flow causes failure login events for OTP not to be sent to the brute force protection event queue, so BruteForceProtector does not handle these events. Affected product: Keycloak (ve...

CVE-2022-1466

CVE-2022-1466 affects Red Hat Single Sign-On (Keycloak-based) where improper authorization allows an authenticated user to perform actions beyond permissions, specifically adding users to the master realm. Root cause: insufficient authorization checks for master-realm actions. Impact: potential u...

CVE-2017-2582

Technical details for CVE-2017-2582 are not publicly available in the provided documents. Monitor for updates as new information becomes available.

CVE-2020-1697

CVE-2020-1697 affects Keycloak versions before 9.0.0 where admin console links to external applications (Application Links) are not validated, allowing an authenticated user to craft links that trigger Stored XSS cross-realm. The issue is evidenced in multiple feeds (Red Hat advisories explicitly...

CVE-2024-4629

The CVE-2024-4629 issue is a brute-force protection bypass in Keycloak/Red Hat Single Sign-On 7.6.10 (and related builds). A timing-based flaw lets parallel login attempts exceed configured failed-attempt limits before lockout, enabling more password guesses. Red Hat has patched this in RHSA advi...

CVE-2020-14389

Keycloak CVE-2020-14389 affects Keycloak prior to 12.0.0. A user with only the view-profile role could manage resources in the New Account Console, enabling access and modification of data the user should not have. The root cause is an elevation of privilege enabling restricted users to perform a...

CVE-2021-3513

CVE-2021-3513 affects Keycloak/Red Hat Single Sign-On; root cause is a wrong error message during credential entry that enables brute-force attempts even with permanent lockout. Impact is confidentiality. Connected docs confirm the issue and reference security advisories, but do not provide expli...

CVE-2019-3875

Keycloak prior to 6.0.2 is affected by CVE-2019-3875 due to missing signatures validation on CRLs used for client-certificate verification. This can enable MITM-style attacks via CRLs obtained over untrusted networks (CDP/HTTP/LDAP). Red Hat’s advisory RHSA-2020:2366 flags this as a security fix,...

CVE-2020-1718

CVE-2020-1718 affects Keycloak: a flaw in the reset credential flow in all Keycloak versions before 8.0.0 allows an attacker to gain unauthorized access to the application. This is corroborated by the GHSA entry describing the same issue. Exploitation status and remediation details are not provid...

CVE-2018-14637

The vulnerability CVE-2018-14637 affects Keycloak prior to 4.6.0.Final, where the SAML broker consumer endpoint ignores expiration checks on SAML assertions. This enables replay attacks against requests authenticated via SAML assertions. Connected advisories (GHSA-GF2J-7QWG-4F5X and related OSV/C...

CVE-2020-10776

Keycloak vulnerability CVE-2020-10776 affects Keycloak up to version 12.0.0, where the redirect_uri parameter could accept unsafe schemes, enabling Cross-site Scripting (XSS). Evidence across multiple sources confirms the flaw and its association with Keycloak prior to 12.0.0 (GHSA-484Q-784P-8M5H...

CVE-2019-10170

CVE-2019-10170 (Keycloak) concerns a flaw in the Keycloak admin console where the realm management interface permits configuring a script via policy. An attacker who already has an authenticated user and realm management permissions can configure a malicious script to trigger and execute arbitrar...

CVE-2019-14820

In Keycloak, versions before 8.0.0 expose internal adapter endpoints via org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This could allow an attacker to access unauthorized information. Affected: Keycloak

CVE-2021-3637

CVE-2021-3637 affects Rational Test Automation Server (Keycloak-based) prior to v10.5 integration, due to a flaw in the keycloak-model-infinispan function. The vulnerability allows the authenticationSessions map in RootAuthenticationSessionEntity to grow boundlessly when a specially crafted reque...

CVE-2019-14837

Keycloak before version 8.0.0 is affected by a logic/identity flaw where the owner of the placeholder.org domain can configure a mail server on that domain and reset a client’s password using only the client name (e.g., [email protected]) to log in. The available public documen...

CVE-2021-3632

CVE-2021-3632 is a Keycloak/WebAuthn flow flaw that allows an attacker to register a new security device or key for any user when no device exists for that user. The issue is present in Red Hat SSO 7.x as part of the 7.4.9 security updates; Red Hat advisories RHSA-2021:3527/3528/3529 list the fix...

CVE-2020-1724

CVE-2020-1724 – Keycloak privacy exposure before 9.0.2 : A flaw in Keycloak (versions before 9.0.2) allows a malicious user who is currently logged in to see the personal information of a previously logged-out user in the account manager section. The description and connected sources confirm the ...

CVE-2019-10169

Keycloak UMA policy abuse (CVE-2019-10169) enables an authenticated attacker with UMA permissions to set a malicious script in the user-managed access policy, triggering execution of code with the permissions of the running application user. The core issue is a script in UMA policy configuration ...

CVE-2020-10758

Keycloak vulnerability CVE-2020-10758 (Keycloak before 11.0.1) enables DoS by sending twenty requests in parallel where each request has a Content-Length larger than the actual body. The underlying issue is a mismatch between declared and actual request size, allowing resource exhaustion that can...

CVE-2020-14366

Keycloak has a path traversal vulnerability where the resources endpoint maps URL paths to file paths, allowing exposure of limited folder hierarchies via URL-encoded path segments. This is due to a transformation of the URL path to a file path at the resources endpoint. The practical impact stat...

CVE-2021-20202

CVE-2021-20202 affects Keycloak. A flaw allows a local attacker to create temporary-directory paths before the Java process, with broader permissions, enabling access to data stored by Keycloak in that directory. Public advisories (GHSA, OSV, NVD, Reddit/RH) describe the same issue and note local...

CVE-2020-1694

Summary: CVE-2020-1694 affects Keycloak before 10.0.0 where the NodeJS adapter did not support verify-token-audience, enabling some users to access sensitive information outside their permissions. What’s affected: Keycloak (and Red Hat SSO built on Keycloak) with the NodeJS adapter lacking verify...

CVE-2020-1728

CVE-2020-1728 affects Red Hat’s Red Hat Single Sign-On / Keycloak projects. The issue is described as security headers missing on REST endpoints for Keycloak, which could ease client-side attacks like clickjacking or other header-reliant abuse. The connected Red Hat advisories explicitly link thi...

CVE-2019-10157

CVE-2019-10157 affects Keycloak’s Node.js adapter prior to 4.8.3. The vulnerability arises from improper verification of the web token received during backchannel logout, enabling a local attacker to craft a malicious JWT with an manipulated NBF value that could prevent a user from gaining access...

CVE-2019-14832

CVE-2019-14832 affects Keycloak REST API prior to 8.0.0, allowing an authenticated attacker who knows a user id to access information across realms the user is not configured for, i.e., a cross-realm user access/authorization bypass. Concrete details from connected docs confirm the vulnerability ...

CVE-2017-2585

CVE-2017-2585 affects Red Hat Keycloak before version 2.5.1, where JWS token HMAC verification is implemented in non-constant time, potentially enabling timing attacks. Documents across OSV/GHSA/NVD reiterate this exact flaw for Keycloak; no explicit exploit details or affected version ranges bey...

CVE-2020-14302

Keycloak before 13.0.0 is vulnerable to CVE-2020-14302 due to a mis-handling of the state parameter at the redirect_uri endpoint after authenticating with an external identity provider. The endpoint accepts multiple invocations using the same state, enabling replay attacks. The issue affects Keyc...

CVE-2021-3856

CVE-2021-3856 concerns Keycloak components ClassLoaderTheme and ClasspathThemeResourceProviderFactory . The vulnerability allows an external HTTP client to request theme resources using a relative path and retrieve the contents of arbitrary files that are present as resources in the classloader. ...

CVE-2020-1727

CVE-2020-1727 affects Keycloak prior to 9.0.2. Description in connected Red Hat advisories confirms a missing input validation in IDP authorization URLs, enabling crafting of deep links that may enable further attack scenarios. Mitigation is to apply the referenced security update (e.g., Red Hat ...

CVE-2016-8629

CVE-2016-8629 affects Red Hat Keycloak prior to version 2.4.0. The vulnerability is a failure to properly enforce permissions when handling service account user deletion requests sent to the REST server. An attacker with service account authentication could bypass normal permissions and delete us...

CVE-2018-10912

Keycloak before 4.0.0.final is vulnerable to an infinite loop in session replacement, which could allow a malicious authenticated user to cause a Denial of Service on a multi-node cluster. Red Hat advisories reference CVE-2018-10912 and list a fix in later releases (e.g., Red Hat SSO 7.2.4) and a...

CVE-2020-27838

Keycloak before 13.0.0 contains an information disclosure: the client registration endpoint allows fetching information about PUBLIC clients (e.g., client secrets) without authentication, which could threaten data confidentiality if a PUBLIC client is later changed to CONFIDENTIAL. Affected: Keyc...

CVE-2020-1698

CVE-2020-1698 affects Keycloak prior to 9.0.0. A logged exception in the HttpMethod class may leak the password supplied as a parameter, exposing sensitive data in log files and impacting data confidentiality. The available sources indicate the issue is addressed in versions released after 9.0.0;...