Keycloak-core: open redirect on account page

A flaw was found in Keycloak

A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers

A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak

A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances

JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL

A flaw was found in JBOSS Keycloak 3.2.1.Final

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some…

A flaw was found in Keycloak in versions before 10.0.0, where it does not perform the TLS hostname verification while sending emails using the SMTP server

Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the…

A flaw was found in keycloak before version 9.0.1

A flaw was found in keycloak in versions before 9.0.0

It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token

A flaw was found in Keycloak in the execute-actions-email endpoint

A flaw was found in Keycloak

A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0

A flaw was found in keycloak before version 13.0.0

A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of…

A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in…

It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored…

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final

It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates

A vulnerability was found in Keycloak-services

A flaw was found in Keycloak

A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user

A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests

Org.keycloak/keycloak-services: keycloak: unauthorized modification of unmanaged user attributes by administrators

A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that accepts multiple invocations…

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience

keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement

A flaw was found in Keycloak

A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter

A vulnerability was found in keycloak before 6.0.2

A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself

ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader

A flaw was found in Keycloak in versions before 9.0.2

It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL

JBoss KeyCloak is vulnerable to soft token deletion via CSRF

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API

A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection

Org.keycloak/keycloak-services: webauthn attestation statement verification bypass

A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure

A flaw was found in Keycloak 7.0.1