Search for packages
| purl | pkg:maven/org.keycloak/keycloak-core@1.9.0.CR1 |
| Next non-vulnerable version | None. |
| Latest non-vulnerable version | None. |
| Risk score | 9.6 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-959q-32g8-vvp7
Aliases: CVE-2017-12161 |
Moderate severity vulnerability that affects org.keycloak:keycloak-core It was found that keycloak before 3.4.2 final would permit misuse of a client-side … | There are no reported fixed by versions. |
|
GHSA-qgm9-232x-hwpx
Aliases: CVE-2017-1000500 |
Moderate severity vulnerability that affects org.keycloak:keycloak-core Withdrawn: Duplicate of CVE-2017-12161 / GHSA-959q-32g8-vvp7 | There are no reported fixed by versions. |
|
GHSA-778x-2mqv-w6xw
Aliases: CVE-2016-8629 |
Moderate severity vulnerability that affects org.keycloak:keycloak-core Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service … | There are no reported fixed by versions. |
|
GHSA-h7j7-pw3v-3v3x
Aliases: CVE-2018-10912 |
Moderate severity vulnerability that affects org.keycloak:keycloak-core keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A … | There are no reported fixed by versions. |
|
GHSA-c9x9-xv66-xp3v
Aliases: CVE-2020-14389 |
Improper privilege management in Keycloak A flaw was found in Keycloak, where it would permit a user with a view-profile … |
Vulnerable |
|
GHSA-7m27-3587-83xf
Aliases: CVE-2019-10170 |
Privilege Defined With Unsafe Actions in Keycloak A flaw was found in the Keycloak admin console, where the realm management … |
Vulnerable |
|
GHSA-q6w2-89hq-hq27
Aliases: CVE-2021-20195 |
keycloak Self Stored Cross-site Scripting vulnerability A flaw was found in keycloak in versions before 13.0.0. A Self Stored XSS … |
Vulnerable |
|
GHSA-xf46-8vvp-4hxx
Aliases: CVE-2021-20262 |
Keycloak Missing authentication for critical function A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating … | There are no reported fixed by versions. |
|
GHSA-4gf2-xv97-63m2
Aliases: CVE-2020-1744 |
Exposure of Sensitive Information in keycloak A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP … | There are no reported fixed by versions. |
|
GHSA-q4xq-445g-g6ch
Aliases: CVE-2024-4028 |
Keycloak allows cross-site scripting (XSS) A vulnerability was found in Keycloak. This issue may allow a privileged attacker to use … | There are no reported fixed by versions. |
|
GHSA-755v-r4x4-qf7m
Aliases: GMS-2022-7509 |
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown ### Summary A Stored XSS vulnerability was reported in the Keycloak … |
Vulnerable |
|
GHSA-f32v-vf79-p29q
Aliases: CVE-2022-1466 |
Improper authorization in Keycloak Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they … |
Vulnerable |
|
GHSA-m6mm-q862-j366
Aliases: CVE-2020-1714 |
Improper Input Validation in Keycloak A flaw was found in Keycloak before version 11.0.0, where the code base contains usages … |
Vulnerable |
|
GHSA-jh7q-5mwf-qvhw
Aliases: CVE-2020-10770 |
Keycloak vulnerable to Server-Side Request Forgery A flaw was found in Keycloak before 13.0.0, where it is possible to force … |
Vulnerable |
|
GHSA-8xj2-47xw-q78c
Aliases: CVE-2020-1724 |
Keycloak Insufficient Session Expiry A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user … |
Vulnerable |
|
GHSA-9695-w6h2-jpv9
Aliases: CVE-2020-10686 |
Keycloak users may be able to remove MFA from other users' devices A community-only flaw was found where a malicious … |
Vulnerable |
|
GHSA-qgmm-f2qw-r95f
Aliases: CVE-2020-1698 |
Keycloak leaks sensitive information in logged exceptions A flaw was found in keycloak in versions before 9.0.0. A logged exception … |
Vulnerable |
|
GHSA-pcv5-m2wh-66j3
Aliases: CVE-2020-27838 |
Keycloak discloses information without authentication A flaw was found in keycloak in versions prior to 13.0.0. The client registration endpoint … |
Vulnerable |
|
GHSA-fqc7-5xxc-ph7r
Aliases: CVE-2022-0225 |
Keycloak XSS via use of malicious payload as group name when creating new group from admin console A flaw was … | There are no reported fixed by versions. |
|
GHSA-j9xq-j329-2xvg
Aliases: CVE-2021-3754 |
Duplicate Advisory: Keycloak user may register themselves with same email ID of any existing user # Duplicate Advisory This advisory … | There are no reported fixed by versions. |
|
GHSA-rpj2-w6fr-79hc
Aliases: CVE-2020-35509 |
Keycloak vulnerable to Improper Certificate Validation keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp … |
Vulnerable |
|
GHSA-qpq9-jpv4-6gwr
Aliases: CVE-2021-3632 |
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow A … |
Vulnerable |
|
GHSA-3w4v-rvc4-2xpw
Aliases: CVE-2021-3856 |
Keycloak has Files or Directories Accessible to External Parties ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource … |
Vulnerable |
|
GHSA-6xp6-fmc8-pmmr
Aliases: CVE-2021-20202 |
Temporary Directory Hijacking Vulnerability in Keycloak A flaw was found in keycloak. Directories can be created prior to the Java … |
Vulnerable |
|
GHSA-m9cj-v55f-8x26
Aliases: CVE-2020-27826 |
Authentication Bypass in keycloak A flaw was found in Keycloak before version 12.0.0 where it is possible to update the … |
Vulnerable |
|
GHSA-w8v7-c7pm-7wfr
Aliases: CVE-2022-2256 |
Duplicate Advisory: Keycloak vulnerable to Cross-Site Scripting (XSS) ## Duplicate Advisory This advisory is a duplicate of [GHSA-w9mf-83w3-fv49](https://github.com/advisories/GHSA-w9mf-83w3-fv49). This link … | There are no reported fixed by versions. |
|
GHSA-4fgq-gq9g-3rw7
Aliases: CVE-2019-10201 |
Improper Verification of Cryptographic Signature in keycloak It was found that Keycloak's SAML broker, versions up to 6.0.1, did not … |
Vulnerable |
|
GHSA-93ww-43rr-79v3
Aliases: CVE-2024-10039 |
Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination A vulnerability was found in Keycloak. Deployments of Keycloak with a … |
Vulnerable |
|
GHSA-xmmm-jw76-q7vg
Aliases: CVE-2024-7318 |
Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity A vulnerability was found in Keycloak. Expired OTP codes … | There are no reported fixed by versions. |
|
GHSA-3hrr-xwvg-hxvr
|
Duplicate Advisory: Keycloak DoS via account lockout # Duplicate Advisory This advisory has been withdrawn because it is a duplicate … |
Vulnerable |
|
GHSA-gmrm-8fx4-66x7
Aliases: CVE-2024-5967 |
Duplicate Advisory: Keycloak: Leak of configured LDAP bind credentials ## Duplicate Advisory This advisory has been withdrawn because it is … | There are no reported fixed by versions. |
|
GHSA-9vm7-v8wj-3fqw
Aliases: CVE-2023-6927 GMS-2024-51 |
keycloak-core: open redirect via "form_post.jwt" JARM response mode An incomplete fix was found in Keycloak Core patch. An attacker can … |
Vulnerable |
|
GHSA-57rh-gr4v-j5f6
|
Duplicate Advisory: Keycloak Uses a Key Past its Expiration Date # Duplicate Advisory This advisory has been withdrawn because it … | There are no reported fixed by versions. |
|
GHSA-g4gc-rh26-m3p5
Aliases: CVE-2024-7260 |
Keycloak Open Redirect vulnerability An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where … | There are no reported fixed by versions. |
|
GHSA-w97f-w3hq-36g2
Aliases: CVE-2023-6841 |
Keycloak Denial of Service vulnerability A denial of service vulnerability was found in keycloak where the amount of attributes per … |
Vulnerable |
|
GHSA-5cc8-pgp5-7mpm
Aliases: CVE-2023-1664 |
Keycloak Untrusted Certificate Validation vulnerability A flaw was found in keycloak-core. This flaw considers the scenario when using X509 Client … |
Vulnerable |
|
GHSA-c892-cwq6-qrqf
Aliases: CVE-2023-1664 |
Duplicate Advisory: Keycloak vulnerable to untrusted certificate validation ## Duplicate Advisory This advisory has been withdrawn because it is a … | There are no reported fixed by versions. |
|
GHSA-c7xw-p58w-h6fj
Aliases: CVE-2023-0105 GHSA-vhvq-jh34-3fc8 |
Keycloak: Impersonation and lockout possible through incorrect handling of email trust Impersonation and lockout are possible due to email trust … |
Vulnerable |
|
GHSA-vhvq-jh34-3fc8
|
Duplicate Advisory: Keycloak allows impersonation and lockout due to email trust not being handled correctly ## Duplicate Advisory This advisory … | There are no reported fixed by versions. |
|
GHSA-v436-q368-hvgg
Aliases: CVE-2023-0091 GMS-2023-37 |
Keycloak has lack of validation of access token on client registrations endpoint When a service account with the create-client or … |
Vulnerable |
|
GHSA-3gg7-9q2x-79fc
Aliases: CVE-2020-1728 |
Improper Restriction of Rendered UI Layers or Frames in Keycloak A vulnerability was found in all versions of Keycloak where, … | There are no reported fixed by versions. |
|
GHSA-6pmv-7pr9-cgrj
Aliases: CVE-2020-1731 |
Predictable password in Keycloak A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where … |
Vulnerable |
|
GHSA-xfqh-7356-vqjj
Aliases: CVE-2019-14820 |
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak It was found that keycloak before version 8.0.0 exposes internal … |
Vulnerable |
|
GHSA-8vf3-4w62-m3pq
Aliases: CVE-2020-1697 |
XSS in Keycloak It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in … |
Vulnerable |
|
CVE-2021-20195
|
Improper Input Validation A flaw was found in keycloak A Self Stored XSS attack vector escalating to a complete account … |
Vulnerable |
|
CVE-2020-1725
|
Exposure of Resource to Wrong Sphere A flaw was found in keycloak In some scenarios a user still has access … |
Vulnerable |
|
CVE-2024-1722
Aliases: GHSA-3hrr-xwvg-hxvr |
Keycloak DoS via account lockout A flaw was found in Keycloak. In certain conditions, this issue may allow a remote … | There are no reported fixed by versions. |
|
CVE-2023-6134
|
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') A flaw was found in Keycloak that … |
Vulnerable |
|
CVE-2020-1758
|
Improper Certificate Validation A flaw was found in Keycloak where it does not perform the TLS hostname verification while sending … |
Vulnerable |
|
CVE-2023-6291
|
URL Redirection to Untrusted Site ('Open Redirect') A flaw was found in the redirect_uri validation logic in Keycloak. This issue … |
Vulnerable |
|
CVE-2022-1274
Aliases: GHSA-m4fv-gm5m-4725 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') A flaw was found in Keycloak in the execute-actions-email endpoint. … |
Vulnerable |
|
CVE-2020-1728
|
Improper Restriction of Rendered UI Layers or Frames A vulnerability was found in Keycloak where the pages on the Admin … |
Vulnerable |
|
CVE-2020-27838
|
Improper Authentication A flaw was found in keycloak The client registration endpoint allows fetching information about PUBLIC clients (like client … | There are no reported fixed by versions. |
|
CVE-2020-1718
|
Improper Authentication A flaw was found in the reset credential flow which allows an attacker to gain unauthorized access to … |
Vulnerable |
|
CVE-2022-3916
|
Insufficient Session Expiration A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared … |
Vulnerable |
|
CVE-2020-10776
|
Cross-site Scripting A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirect_uri parameter. … |
Vulnerable |
|
GHSA-c77r-6f64-478q
Aliases: CVE-2017-2582 |
keycloak-core discloses system properties It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 … | There are no reported fixed by versions. |
|
GHSA-95m6-mjh3-58gm
Aliases: CVE-2016-8609 |
Improper Authentication in org.keycloak:keycloak-core It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker … | There are no reported fixed by versions. |
|
GHSA-w6gv-3r3v-gwgj
Aliases: CVE-2017-2585 |
keycloak-core vulnerable to timing attacks against JWS token verification Red Hat Keycloak before version 2.5.1 has an implementation of HMAC … | There are no reported fixed by versions. |
|
GHSA-jc6q-27mw-p55w
Aliases: CVE-2017-2646 |
Keycloak vulnerable to infinite loop based Denial of Service When Keycloak versions prior to 2.5.5 receive a Logout request with … | There are no reported fixed by versions. |
|
GHSA-gf2j-7qwg-4f5x
Aliases: CVE-2018-14637 |
Improper Authentication in Keycloak The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. … | There are no reported fixed by versions. |
|
GHSA-3qh2-mccc-q5m6
Aliases: CVE-2018-14658 |
Keycloak Open Redirect A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are … | There are no reported fixed by versions. |
|
GHSA-cf8f-w2c5-p5jr
Aliases: CVE-2019-14837 |
keycloak vulnerable to unauthorized login via mail server setup A flaw was found in keycloack before version 8.0.0. The owner … |
Vulnerable Vulnerable |
|
GHSA-gc52-xj6p-9pxp
Aliases: CVE-2019-3868 |
Exposure of Sensitive Information to an Unauthorized Actor in Keycloak Keycloak up to version 6.0.0 allows the end user token … |
Vulnerable Vulnerable |
|
GHSA-38cg-gg9j-q9j9
Aliases: CVE-2019-3875 |
Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak A vulnerability was found in keycloak before 6.0.2. The … | There are no reported fixed by versions. |
|
GHSA-p5xp-6vpf-jwvh
Aliases: CVE-2019-10199 |
Improper Input Validation and Cross-Site Request Forgery in Keycloak It was found that Keycloak's account console, up to 6.0.1, did … |
Vulnerable Vulnerable |
|
CVE-2020-10770
|
Server-Side Request Forgery (SSRF) A flaw was found in Keycloak, where it is possible to force the server to call … |
Vulnerable Vulnerable |
|
CVE-2021-3513
|
Generation of Error Message Containing Sensitive Information A flaw was found in keycloak where a brute force attack is possible … |
Vulnerable Vulnerable |
|
CVE-2020-14302
|
Authentication Bypass by Capture-replay A flaw was found in Keycloak where an external identity provider, after successful authentication, redirects to … |
Vulnerable Vulnerable |
|
CVE-2018-10894
Aliases: GHSA-xvv8-8wh9-9fh2 |
Improper Certificate Validation It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could … | There are no reported fixed by versions. |