Filtered by vendor Redhat Subscriptions
Filtered by product Keycloak Subscriptions
Total 89 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-12160 1 Redhat 3 Jboss Single Sign On, Keycloak, Red Hat Single Sign On 2024-11-21 7.2 High
It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. An attacker on an already compromised resource could use this flaw to grant himself continued permissions and possibly conduct further attacks.
CVE-2016-8629 1 Redhat 5 Enterprise Linux Server, Jboss Single Sign On, Keycloak and 2 more 2024-11-21 N/A
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.
CVE-2016-8627 1 Redhat 2 Jboss Enterprise Application Platform, Keycloak 2024-11-21 N/A
admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks. An attacker could trigger the user's browser to request the log files consuming enough resources that normal server functioning could be impaired.
CVE-2016-8609 1 Redhat 2 Jboss Single Sign On, Keycloak 2024-11-21 N/A
It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. An attacker could use this flaw to construct a phishing URL, from which he could hijack the user's session. This could lead to information disclosure, or permit further possible attacks.
CVE-2014-3655 1 Redhat 2 Jboss Enterprise Web Server, Keycloak 2024-11-21 4.3 Medium
JBoss KeyCloak is vulnerable to soft token deletion via CSRF
CVE-2014-3652 1 Redhat 1 Keycloak 2024-11-21 6.1 Medium
JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.
CVE-2023-6841 1 Redhat 7 Jboss Enterprise Bpms Platform, Jboss Fuse, Keycloak and 4 more 2024-11-15 7.5 High
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
CVE-2024-7260 1 Redhat 3 Build Keycloak, Build Of Keycloak, Keycloak 2024-10-08 6.1 Medium
An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks. Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.
CVE-2024-7341 1 Redhat 8 Build Keycloak, Build Of Keycloak, Enterprise Linux and 5 more 2024-10-04 7.1 High
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.