Redhat.Com Keycloak vulnerabilities

2 vulnerabilities

Known vulnerabilities in Redhat.Com Keycloak, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

9.1CVE-2022-3782org.keycloakkeycloak-parent+2
EPSS score
5.80%
keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.5CVE-2023-0264chainguardkeycloak+8
EPSS score
1.27%
A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, integrity, and availability.