Search for packages
| purl | pkg:maven/org.keycloak/keycloak-model-jpa@4.3.0.Final |
| Advisory | Summary | Fixed in package version |
|---|---|---|
|
GHSA-8prc-58j4-m55q
Aliases: CVE-2019-14832 |
Keycloak Unauthenticated Access A flaw was found in the Keycloak REST API before version 8.0.0, implemented in Keycloak before 7.0.1 … |
Vulnerable |
|
GHSA-54f3-c6hg-865h
Aliases: CVE-2023-6563 |
Allocation of Resources Without Limits in Keycloak An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered … |
Vulnerable |
|
GHSA-q35r-vvhv-vx5h
Aliases: CVE-2026-3190 |
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure A flaw was found in Keycloak. … |
Not vulnerable |
|
CVE-2020-1725
|
Exposure of Resource to Wrong Sphere A flaw was found in keycloak In some scenarios a user still has access … |
Vulnerable |
|
CVE-2023-6291
|
URL Redirection to Untrusted Site ('Open Redirect') A flaw was found in the redirect_uri validation logic in Keycloak. This issue … |
Vulnerable |
|
CVE-2020-27838
|
Improper Authentication A flaw was found in keycloak The client registration endpoint allows fetching information about PUBLIC clients (like client … | There are no reported fixed by versions. |
|
CVE-2022-3916
|
Insufficient Session Expiration A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared … |
Vulnerable |
|
CVE-2020-10776
|
Cross-site Scripting A flaw was found in Keycloak, where it is possible to add unsafe schemes for the redirect_uri parameter. … |
Vulnerable |
|
CVE-2020-10770
|
Server-Side Request Forgery (SSRF) A flaw was found in Keycloak, where it is possible to force the server to call … |
Vulnerable Vulnerable |
|
CVE-2020-14389
|
Improper Privilege Management It was found that Keycloak would permit a user with only view-profile role to manage the resources … |
Vulnerable Vulnerable |
|
CVE-2020-14302
|
Authentication Bypass by Capture-replay A flaw was found in Keycloak where an external identity provider, after successful authentication, redirects to … |
Vulnerable Vulnerable |