Product:

Keycloak

(Redhat)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 88
Date Id Summary Products Score Patch Annotated
2020-11-17 CVE-2020-10776 A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack. Keycloak 4.8
2017-10-26 CVE-2017-12160 It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks. Keycloak N/A
2019-04-24 CVE-2019-3868 Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session. Keycloak 3.8
2020-01-07 CVE-2019-14837 A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'. Keycloak, Single_sign\-On N/A
2019-12-05 CVE-2019-14910 A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered. Keycloak N/A
2019-12-04 CVE-2019-14909 A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted. Keycloak N/A
2019-12-15 CVE-2014-3652 JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL. Keycloak N/A
2019-10-15 CVE-2019-14832 A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks. Keycloak N/A
2019-11-13 CVE-2014-3655 JBoss KeyCloak is vulnerable to soft token deletion via CSRF Jboss_enterprise_web_server, Keycloak N/A
2019-08-14 CVE-2019-10201 It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information. Keycloak, Single_sign\-On 8.1