Search for packages
purl | pkg:maven/org.keycloak/keycloak-model-jpa@21.0.0 |
Vulnerability | Summary | Fixed by |
---|---|---|
VCID-kfzc-yxas-aaad
Aliases: CVE-2023-6291 GHSA-mpwq-j3xf-7m5w |
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted |
Affected by 0 other vulnerabilities. |
Vulnerability | Summary | Aliases |
---|---|---|
VCID-s711-x8ae-aaaj | An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments which have millions of offline tokens (> 500,000 users with each having at least 2 saved sessions). If an attacker creates two or more user sessions and then open the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions leading to excessive memory and CPU consumption which could potentially crash the entire system. |
CVE-2023-6563
GHSA-54f3-c6hg-865h |