CVE-2019-14832

keycloak: cross-realm user access auth bypass

A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more

CVE-2019-14820

keycloak: adapter endpoints are exposed via arbitrary URLs

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Jboss Fuse Jboss Single Sign On and 4 more

CVE-2019-10201

keycloak: SAML broker does not check existence of signature on document allowing any user impersonation

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more

CVE-2019-10199

keycloak: CSRF check missing in My Resources functionality in the Account Console

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Openshift Application Runtimes

CVE-2019-10170

keycloak: script execution via realm management policy trigger

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. This flaw allows an attacker with authenticated user and realm management permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the application user.

CVSS 3.1 · 6.6 Medium EPSS 1.2% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak

CVE-2019-10169

keycloak: script execution via UMA policy trigger

A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy. This flaw allows an authenticated attacker with UMA permissions to configure a malicious script to trigger and execute arbitrary code with the permissions of the user running application.

CVSS 3.1 · 6.6 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak

CVE-2019-10157

keycloak: Node.js adapter internal NBF can be manipulated leading to DoS.

It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.

CVSS 3.0 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Single Sign-on

CVE-2018-14658

keycloak: Open Redirect in Login and Logout

A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack

CVSS 3.0 · 6.1 Medium EPSS 1.1% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Red Hat Single Sign On

CVE-2018-14657

keycloak: brute force protection not working for the entire login workflow

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.

CVSS 3.1 · 8.1 High EPSS 1.2% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Linux and 2 more

CVE-2018-14655

keycloak: XSS-Vulnerability with response_mode=form_post

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

CVSS 3.0 · 4.6 Medium EPSS 1.2% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Linux and 2 more

CVE-2018-14637

keycloak: expiration not validated in SAML broker consumer endpoint

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Red Hat Single Sign On

CVE-2018-10912

keycloak: infinite loop in session replacement leading to denial of service

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.

CVSS 3.1 · 4.9 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Jboss Single Sign On Keycloak Openshift Application Runtimes and 1 more

CVE-2018-10894

keycloak: auth permitted with expired certs in SAML client

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.

CVSS 3.0 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Single Sign On Keycloak and 3 more

CVE-2017-2646

keycloak: DoS via SAML request

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.

CVSS 3.0 · 7.5 High EPSS 1.8% KEV · Not listed

Vendors

Redhat

Products

Keycloak

CVE-2017-2585

keycloak: timing attack in JWS signature verification

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.

CVSS 3.0 · 5.9 Medium EPSS 2.0% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Server Jboss Single Sign On Keycloak and 2 more

CVE-2017-2582

keycloak: SAML request parser replaces special strings with system properties

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.

CVSS 3.0 · 6.5 Medium EPSS 2.4% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Jboss Enterprise Application Platform Keycloak

CVE-2017-15112

keycloak-httpd-client-install: unsafe use of -p/--admin-password on command line

keycloak-httpd-client-install versions before 0.8 allow users to insecurely pass password through command line, leaking it via command history and process info to other local users.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Keycloak-httpd-client-install Project Redhat

Products

Keycloak-httpd-client-install Enterprise Linux

CVE-2017-15111

keycloak-httpd-client-install: unsafe /tmp log file in --log-file option in keycloak_cli.py

keycloak-httpd-client-install versions before 0.8 insecurely creates temporary file allowing local attackers to overwrite other files via symbolic link.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Keycloak-httpd-client-install Project Redhat

Products

Keycloak-httpd-client-install Enterprise Linux

CVE-2016-8629

keycloak: user deletion via incorrect permissions check

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.

CVSS 3.0 · 6.5 Medium EPSS 1.9% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Server Jboss Single Sign On Keycloak and 2 more

CVE-2016-8627

admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files

admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired.

CVSS 3.0 · 4.3 Medium EPSS 2.6% KEV · Not listed

Vendors

Redhat

Products

Jboss Enterprise Application Platform Keycloak