Red Hat Keycloak vulnerabilities
22 vulnerabilities
Known vulnerabilities in Red Hat Keycloak, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2018-14655org.keycloakkeycloak-parent+3
EPSS score1.19%
A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.CVE-2018-14658org.keycloakkeycloak-core+2EPSS score1.10%
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attackCVE-2018-14657org.keycloakkeycloak-parent+3EPSS score1.16%
A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final. When TOPT enabled, an improper implementation of the Brute Force detection algorithm will not enforce its protection measures.CVE-2018-10894org.keycloakkeycloak-saml-adapter-core+4EPSS score0.35%
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.CVE-2016-8609org.keycloakkeycloak-core+2EPSS score1.68%
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.CVE-2020-1714org.keycloakkeycloak-common+13EPSS score2.60%
A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.CVE-2020-1731org.keycloakkeycloak-core+2EPSS score1.28%
A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random admin password when installing Keycloak, however the password remains the same when deployed to the same OpenShift namespace.CVE-2020-1744org.keycloakkeycloak-core+4EPSS score1.13%
A flaw was found in keycloak before version 9.0.1. When configuring an Conditional OTP Authentication Flow as a post login flow of an IDP, the failure login events for OTP are not being sent to the brute force protection event queue. So BruteForceProtector does not handle this events.CVE-2020-1724org.keycloakkeycloak-core+4EPSS score0.82%
A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section.CVE-2020-1718org.keycloakkeycloak-parent+4EPSS score1.00%
A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0. This flaw allows an attacker to gain unauthorized access to the application.CVE-2020-1758org.keycloakkeycloak-parent+3EPSS score0.93%
A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server. This flaw allows an attacker to perform a man-in-the-middle (MITM) attack.CVE-2020-1697org.keycloakkeycloak-core+3EPSS score0.76%
It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.CVE-2020-1698org.keycloakkeycloak-core+2EPSS score0.37%
A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.CVE-2020-14366org.keycloakkeycloak-parent+2EPSS score1.38%
A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of the url path to the file path. Only few specific folder hierarchies can be exposed by this flawCVE-2017-2646org.keycloakkeycloak-core+2EPSS score1.83%
It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. An attacker could use this flaw to conduct denial of service attacks.CVE-2017-2582org.keycloakkeycloak-core+505EPSS score2.43%
It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the attacked system by formatting the SAML request ID field to be the chosen system property which could be obtained in the "InResponseTo" field in the response.CVE-2019-14837org.keycloakkeycloak-core+3EPSS score1.72%
A flaw was found in keycloack before version 8.0.0. The owner of 'placeholder.org' domain can setup mail server on this domain and knowing only name of a client can reset password and then log in. For example, for client name 'test' the email address will be 'service-account-test@placeholder.org'.CVE-2019-10199org.keycloakkeycloak-core+2EPSS score0.50%
It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. An attacker could use this flaw to trick an authenticated user into performing operations via request from an untrusted domain.CVE-2019-10201org.keycloakkeycloak-core+3EPSS score0.71%
It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. If an attacker modifies the SAML Response and removes the <Signature> sections, the message is still accepted, and the message can be modified. An attacker could use this flaw to impersonate other users and gain access to sensitive information.CVE-2019-10157Npmkeycloak-connect+3EPSS score0.21%
It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.