Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 123

Export CSV
CVE-2020-1714

keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.

CVSS 3.1 · 8.8 High EPSS 2.6% KEV · Not listed
Vendors
Quarkus Redhat
Products
Quarkus Decision Manager Jboss Enterprise Application Platform and 8 more
CVE-2020-1698

keycloak: Password leak by logged exception in HttpMethod class

A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Keycloak Openshift Application Runtimes Red Hat Single Sign On
CVE-2020-1697

keycloak: stored XSS in client settings via application links

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more
CVE-2020-1694

keycloak: verify-token-audience support is missing in the NodeJS adapter

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.

CVSS 3.1 · 4.9 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak
CVE-2020-14389

keycloak: user can manage resources with just "view-profile" role using new Account Console

It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and modification of data the user was not intended to have.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Red Hat Single Sign On
CVE-2020-14366

keycloak: path traversal in resources

A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flaw

CVSS 3.1 · 6.8 Medium EPSS 1.4% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak
CVE-2020-14302

keycloak: reusable "state" parameter at redirect_uri endpoint enables possibility of replay attacks

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations with the use of the same "state" parameter. This flaw allows a malicious user to perform replay attacks.

CVSS 3.1 · 4.9 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Keycloak Red Hat Single Sign On
CVE-2020-10776

keycloak: OIDC redirect_uri allows dangerous schemes resulting in potential XSS

A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Red Hat Single Sign On
CVE-2020-10770

keycloak: Default Client configuration is vulnerable to SSRF using "request_uri" parameter

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.

CVSS 3.1 · 5.3 Medium EPSS 69.7% KEV · Not listed
Vendors
Redhat
Products
Keycloak Red Hat Single Sign On
CVE-2020-10758

keycloak: DoS by sending multiple simultaneous requests with a Content-Length header value greater than actual byte count of request body

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a Content-Length header value that exceeds the actual byte count of the request body.

CVSS 3.1 · 7.5 High EPSS 1.9% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Openshift Application Runtimes and 2 more
CVE-2020-10748

keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)

A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Single Sign-on
CVE-2020-10734

keycloak: OIDC logout endpoint CSRF

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Fuse Keycloak Openshift Application Runtimes and 1 more
CVE-2020-10686

keycloak: remove other users MFA devices

A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Keycloak
CVE-2019-3875

keycloak: missing signatures validation on CRL used to verify client certificates

A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.

CVSS 3.0 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more
CVE-2019-3868

keycloak: session hijack using the user access token

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

CVSS 3.0 · 3.8 Low EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more
CVE-2019-14910

Keycloak: LDAP authentication accepts invalid passwords when using StartTLS

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.

CVSS 3.1 · 9.8 Critical EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Keycloak
CVE-2019-14909

Keycloak: LDAP authentication accepts invalid passwords with bindType none

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.

CVSS 3.1 · 8.3 High EPSS 1.1% KEV · Not listed
Vendors
Redhat
Products
Keycloak
CVE-2019-14837

keycloak: keycloak uses hardcoded open dummy domain for new accounts enabling information disclosure

A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.

CVSS 3.1 · 9.1 Critical EPSS 1.7% KEV · Not listed
Vendors
Redhat
Products
Jboss Single Sign On Keycloak Red Hat Single Sign On and 1 more