Search for packages
| purl | pkg:maven/org.keycloak/keycloak-wildfly-server-subsystem@13.0.0 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk | 4.0 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-7qnt-1wwt-aaap
Aliases: CVE-2022-3916 GHSA-97g8-xfvw-q4hg GMS-2022-8406 |
Keycloak vulnerable to session takeover with OIDC offline refreshtokens | There are no reported fixed by versions. |
|
VCID-kfzc-yxas-aaad
Aliases: CVE-2023-6291 GHSA-mpwq-j3xf-7m5w |
The redirect_uri validation logic allows for bypassing explicitly allowed hosts that would otherwise be restricted | There are no reported fixed by versions. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-5yyq-kxcg-aaas | Improper Authentication A flaw was found in keycloak The client registration endpoint allows fetching information about PUBLIC clients (like client secret) without authentication which could be an issue if the same PUBLIC client changed to CONFIDENTIAL later. The highest threat from this vulnerability is to data confidentiality. |
CVE-2020-27838
GHSA-pcv5-m2wh-66j3 |
| VCID-fccp-mqrj-aaaj | Authentication Bypass by Capture-replay A flaw was found in Keycloak where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same `state` parameter. This flaw allows a malicious user to perform replay attacks. |
CVE-2020-14302
|
| VCID-fk8g-8kjz-aaah | Incorrect Authorization in keycloak |
CVE-2020-1725
GHSA-p225-pc2x-4jpm |
| VCID-rfye-2s3j-aaaf | Code injection in keycloak |
CVE-2021-20222
GHSA-2mq8-99q7-55wx |
| VCID-ydp2-dstr-aaas | Temporary Directory Hijacking Vulnerability in Keycloak |
CVE-2021-20202
GHSA-6xp6-fmc8-pmmr |