Search for packages
| purl | pkg:maven/org.keycloak/keycloak-core@20.0.3 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 3.2 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-q4xq-445g-g6ch
Aliases: CVE-2024-4028 |
Keycloak allows cross-site scripting (XSS) A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use … | There are no reported fixed by versions. |
|
GHSA-93ww-43rr-79v3
Aliases: CVE-2024-10039 |
Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination A vulnerability was found in Keycloak. Deployments of Keycloak with a … |
Vulnerable |
|
GHSA-xmmm-jw76-q7vg
Aliases: CVE-2024-7318 |
Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity A vulnerability was found in Keycloak. Expired OTP codes … | There are no reported fixed by versions. |
|
GHSA-3hrr-xwvg-hxvr
|
Duplicate Advisory: Keycloak DoS via account lockout # Duplicate Advisory This advisory has been withdrawn because it is a duplicate … |
Vulnerable |
|
GHSA-gmrm-8fx4-66x7
Aliases: CVE-2024-5967 |
Duplicate Advisory: Keycloak: Leak of configured LDAP bind credentials ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
GHSA-9vm7-v8wj-3fqw
Aliases: CVE-2023-6927 GMS-2024-51 |
keycloak-core: open redirect via "form_post.jwt" JARM response mode An incomplete fix was found in Keycloak Core patch. An attacker can … |
Vulnerable |
|
GHSA-57rh-gr4v-j5f6
|
Duplicate Advisory: Keycloak Uses a Key Past its Expiration Date # Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-g4gc-rh26-m3p5
Aliases: CVE-2024-7260 |
Keycloak Open Redirect vulnerability An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where … | There are no reported fixed by versions. |
|
GHSA-w97f-w3hq-36g2
Aliases: CVE-2023-6841 |
Keycloak Denial of Service vulnerability A denial of service vulnerability was found in keycloak where the amount of attributes per … |
Vulnerable |
|
GHSA-5cc8-pgp5-7mpm
Aliases: CVE-2023-1664 |
Keycloak Untrusted Certificate Validation vulnerability A flaw was found in keycloak-core. This flaw considers the scenario when using X509 Client … |
Vulnerable |
|
GHSA-c892-cwq6-qrqf
Aliases: CVE-2023-1664 |
Duplicate Advisory: Keycloak vulnerable to untrusted certificate validation ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-c7xw-p58w-h6fj
Aliases: CVE-2023-0105 GHSA-vhvq-jh34-3fc8 |
Keycloak: Impersonation and lockout possible through incorrect handling of email trust Impersonation and lockout are possible due to email trust … |
Vulnerable |
|
CVE-2024-1722
Aliases: GHSA-3hrr-xwvg-hxvr |
Keycloak DoS via account lockout A flaw was found in Keycloak. In certain conditions, this issue may allow a remote … | There are no reported fixed by versions. |
|
CVE-2023-6134
|
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') A flaw was found in Keycloak that … |
Vulnerable |
|
CVE-2023-6291
|
URL Redirection to Untrusted Site ('Open Redirect') A flaw was found in the redirect_uri validation logic in Keycloak. This issue … |
Vulnerable |
|
CVE-2022-1274
Aliases: GHSA-m4fv-gm5m-4725 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A flaw was found in Keycloak in the execute-actions-email endpoint. … |
Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
GHSA-v436-q368-hvgg
|
Keycloak has lack of validation of access token on client registrations endpoint When a service account with the create-client or … |
CVE-2023-0091
GMS-2023-37 |