VulnerableCode Package Details - pkg:maven/org.keycloak/keycloak-core@14.0.0

Vulnerabilities affecting this package (26)

Advisory	Summary	Fixed in package version
GHSA-q4xq-445g-g6ch Aliases: CVE-2024-4028	Keycloak allows cross-site scripting (XSS) A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use …	There are no reported fixed by versions.
GHSA-755v-r4x4-qf7m Aliases: GMS-2022-7509	Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown ### Summary A Stored XSS vulnerability was reported in the Keycloak …	20.0.0 Vulnerable
GHSA-f32v-vf79-p29q Aliases: CVE-2022-1466	Improper authorization in Keycloak Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they …	17.0.1 Vulnerable
GHSA-fqc7-5xxc-ph7r Aliases: CVE-2022-0225	Keycloak XSS via use of malicious payload as group name when creating new group from admin console A flaw was …	There are no reported fixed by versions.
GHSA-j9xq-j329-2xvg Aliases: CVE-2021-3754	Duplicate Advisory: Keycloak user may register themselves with same email ID of any existing user # Duplicate Advisory This advisory …	There are no reported fixed by versions.
GHSA-qpq9-jpv4-6gwr Aliases: CVE-2021-3632	Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow A …	15.1.0 Vulnerable
GHSA-3w4v-rvc4-2xpw Aliases: CVE-2021-3856	Keycloak has Files or Directories Accessible to External Parties ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource …	15.1.0 Vulnerable
GHSA-w8v7-c7pm-7wfr Aliases: CVE-2022-2256	Duplicate Advisory: Keycloak vulnerable to Cross-Site Scripting (XSS) ## Duplicate Advisory This advisory is a duplicate of [GHSA-w9mf-83w3-fv49](https://github.com/advisories/GHSA-w9mf-83w3-fv49). This link …	There are no reported fixed by versions.
GHSA-93ww-43rr-79v3 Aliases: CVE-2024-10039	Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination A vulnerability was found in Keycloak. Deployments of Keycloak with a …	26.0.6 Vulnerable
GHSA-xmmm-jw76-q7vg Aliases: CVE-2024-7318	Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity A vulnerability was found in Keycloak. Expired OTP codes …	There are no reported fixed by versions.
GHSA-3hrr-xwvg-hxvr	Duplicate Advisory: Keycloak DoS via account lockout # Duplicate Advisory This advisory has been withdrawn because it is a duplicate …	24.0.0 Vulnerable
GHSA-gmrm-8fx4-66x7 Aliases: CVE-2024-5967	Duplicate Advisory: Keycloak: Leak of configured LDAP bind credentials ## Duplicate Advisory This advisory has been withdrawn because it is …	There are no reported fixed by versions.
GHSA-9vm7-v8wj-3fqw Aliases: CVE-2023-6927 GMS-2024-51	keycloak-core: open redirect via "form_post.jwt" JARM response mode An incomplete fix was found in Keycloak Core patch. An attacker can …	23.0.4 Vulnerable
GHSA-57rh-gr4v-j5f6	Duplicate Advisory: Keycloak Uses a Key Past its Expiration Date # Duplicate Advisory This advisory has been withdrawn because it …	There are no reported fixed by versions.
GHSA-g4gc-rh26-m3p5 Aliases: CVE-2024-7260	Keycloak Open Redirect vulnerability An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where …	There are no reported fixed by versions.
GHSA-w97f-w3hq-36g2 Aliases: CVE-2023-6841	Keycloak Denial of Service vulnerability A denial of service vulnerability was found in keycloak where the amount of attributes per …	24.0.0 Vulnerable
GHSA-5cc8-pgp5-7mpm Aliases: CVE-2023-1664	Keycloak Untrusted Certificate Validation vulnerability A flaw was found in keycloak-core. This flaw considers the scenario when using X509 Client …	21.1.2 Vulnerable
GHSA-c892-cwq6-qrqf Aliases: CVE-2023-1664	Duplicate Advisory: Keycloak vulnerable to untrusted certificate validation ## Duplicate Advisory This advisory has been withdrawn because it is a …	There are no reported fixed by versions.
GHSA-c7xw-p58w-h6fj Aliases: CVE-2023-0105 GHSA-vhvq-jh34-3fc8	Keycloak: Impersonation and lockout possible through incorrect handling of email trust Impersonation and lockout are possible due to email trust …	22.0.1 Vulnerable
GHSA-vhvq-jh34-3fc8	Duplicate Advisory: Keycloak allows impersonation and lockout due to email trust not being handled correctly ## Duplicate Advisory This advisory …	There are no reported fixed by versions.
GHSA-v436-q368-hvgg Aliases: CVE-2023-0091 GMS-2023-37	Keycloak has lack of validation of access token on client registrations endpoint When a service account with the create-client or …	20.0.3 Vulnerable
CVE-2024-1722 Aliases: GHSA-3hrr-xwvg-hxvr	Keycloak DoS via account lockout A flaw was found in Keycloak. In certain conditions, this issue may allow a remote …	There are no reported fixed by versions.
CVE-2023-6134	Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') A flaw was found in Keycloak that …	23.0.0 Vulnerable
CVE-2023-6291	URL Redirection to Untrusted Site ('Open Redirect') A flaw was found in the redirect_uri validation logic in Keycloak. This issue …	23.0.0 Vulnerable
CVE-2022-1274 Aliases: GHSA-m4fv-gm5m-4725	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A flaw was found in Keycloak in the execute-actions-email endpoint. …	20.0.5 Vulnerable
CVE-2022-3916	Insufficient Session Expiration A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared …	20.0.2 Vulnerable

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk score	3.4