A privilege escalation flaw was found in the token exchange feature of keycloak

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case…

A flaw was found in keycloak in versions before 13.0.0

keycloak: path traversal via double URL encoding

A flaw was found in keycloack before version 8.0.0

Org.keycloak.broker.saml: keycloak saml broker: authentication bypass due to disabled saml client completing idp-initiated login

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile

A flaw was found in Keycloak in versions from 12.0.0 and before 15.1.1 which allows an attacker with any existing user account to create new default user accounts via the…

A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks

A flaw was found in the reset credential flow in all Keycloak versions before 8.0.0

It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect

It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new account console, allowing access and…

It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions

A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final

It was found that the keycloak before 2.3.0 did not implement authentication flow correctly

An unconstrained memory consumption vulnerability was discovered in Keycloak

Keycloak: amount of attributes per object is not limited and it may lead to dos

A flaw was found in Keycloak

A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled

A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could…

A flaw was found in keycloak

A vulnerability was found in keycloak, where path traversal using URL-encoded path segments in the request is possible because the resources endpoint applies a transformation of…

A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a…

A flaw was found in the Keycloak REST API before version 8.0.0 where it would permit user access from a realm the user was not configured

It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite…

A flaw was found in keycloak

An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled

A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy

A flaw was found in Keycloak’s user-managed access interface, where it would permit a script to be set in the UMA policy

It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the…

A flaw was found in Keycloak

Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

A flaw was found in the redirect_uri validation logic in Keycloak

A flaw was found in Keycloak

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute…

A flaw was found in the offline_access scope in Keycloak

A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed

A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password

Keycloak: potential bypass of brute force protection

A flaw was found in Keycloak

A flaw was found in Keycloak

Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform

A flaw was found in keycloak in versions prior to 13.0.0

It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property

admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them…

Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server