Filtered by vendor Redhat Subscriptions
Filtered by product Single Sign On Subscriptions
Total 4 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2017-12158 2 Keycloak, Redhat 5 Keycloak, Enterprise Linux Server, Jboss Single Sign On and 2 more 2024-09-16 N/A
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.
CVE-2017-2585 1 Redhat 5 Enterprise Linux Server, Jboss Single Sign On, Keycloak and 2 more 2024-09-16 N/A
Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks.
CVE-2017-12159 2 Keycloak, Redhat 5 Keycloak, Enterprise Linux Server, Jboss Single Sign On and 2 more 2024-09-16 N/A
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.
CVE-2016-8629 1 Redhat 5 Enterprise Linux Server, Jboss Single Sign On, Keycloak and 2 more 2024-09-16 N/A
Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. An attacker with service account authentication could use this flaw to bypass normal permissions and delete users in a separate realm.