Search for packages
| purl | pkg:maven/org.keycloak/keycloak-model-jpa@12.0.0 |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-54f3-c6hg-865h
Aliases: CVE-2023-6563 |
Allocation of Resources Without Limits in Keycloak An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered … |
Vulnerable |
|
GHSA-q35r-vvhv-vx5h
Aliases: CVE-2026-3190 |
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure A flaw was found in Keycloak. … |
Not vulnerable |
|
CVE-2020-1725
|
Exposure of Resource to Wrong Sphere A flaw was found in keycloak In some scenarios a user still has access … |
Vulnerable |
|
CVE-2023-6291
|
URL Redirection to Untrusted Site ('Open Redirect') A flaw was found in the redirect_uri validation logic in Keycloak. This issue … |
Vulnerable |
|
CVE-2020-27838
|
Improper Authentication A flaw was found in keycloak The client registration endpoint allows fetching information about PUBLIC clients (like client … | There are no reported fixed by versions. |
|
CVE-2021-20222
|
Improper Input Validation The new account console in keycloak can allow malicious code to be executed using the referrer URL. … |
Vulnerable |
|
CVE-2021-20262
|
Missing Authentication for Critical Function A flaw was found in Keycloak where re-authentication does not occur while updating the password. … |
Vulnerable |
|
CVE-2022-3916
|
Insufficient Session Expiration A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared … |
Vulnerable |
|
CVE-2020-10770
|
Server-Side Request Forgery (SSRF) A flaw was found in Keycloak, where it is possible to force the server to call … |
Vulnerable Vulnerable |
|
CVE-2020-14302
|
Authentication Bypass by Capture-replay A flaw was found in Keycloak where an external identity provider, after successful authentication, redirects to … |
Vulnerable Vulnerable |
| Advisory | Summary | Aliases |
|---|---|---|
|
CVE-2020-10776
|
Cross-site Scripting A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirect_uri parameter. … | |
|
CVE-2020-14389
|
Improper Privilege Management It was found that Keycloak would permit a user with only view-profile role to manage the resources … |