SS
Product
Single Sign ON
114
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 47Medium 51Low 6
Watch
Add Single Sign ON to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-12159 | 7.5 | Oct 26 | It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session Affected: 7.0; 7.1 |
| CVE-2026-3121 | 7.2 | Mar 26 | Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission Affected: 7.0 |
| CVE-2022-2668 | 7.2 | Aug 5 | An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled Affected: 7.0 |
| CVE-2024-7341 | 7.1 | Sep 9 | Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters Affected: 7.6 before 7.6.10 |
| CVE-2023-6291 | 7.1 | Jan 26 | A flaw was found in the redirect_uri validation logic in Keycloak Affected: 7.6 |
| CVE-2023-2422 | 7.1 | Oct 4 | A flaw was found in Keycloak Affected: 7.6 |
| CVE-2021-3461 | 7.1 | Apr 1 | A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute… Affected: 7.0; 7.4; 7.4.7 |
| CVE-2022-3916 | 6.8 | Sep 20 | A flaw was found in the offline_access scope in Keycloak Affected: 7.6 |
| CVE-2021-3827 | 6.8 | Aug 23 | A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed Affected: 7.0; 7.5.0 |
| CVE-2021-20262 | 6.8 | Mar 9 | A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password Affected: 7.0 |
| CVE-2024-4629 | 6.5 | Sep 3 | Keycloak: potential bypass of brute force protection Affected: 7.6 before 7.6.10 |
| CVE-2023-1664 | 6.5 | May 26 | A flaw was found in Keycloak Affected: 7.0 |
| CVE-2022-1466 | 6.5 | Apr 26 | Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform Affected: 7.5.0 |
| CVE-2020-27838 | 6.5 | Mar 8 | A flaw was found in keycloak in versions prior to 13.0.0 Affected: 7.0 |
| CVE-2020-25689 | 6.5 | Nov 2 | A memory leak flaw was found in WildFly in all versions up to 21.0.0.Final, where host-controller tries to reconnect in a loop, generating new connections which are not properly… Affected: 7.0 |
| CVE-2020-14299 | 6.5 | Oct 16 | A flaw was found in JBoss EAP, where the authentication configuration is set-up using a legacy SecurityRealm, to delegate to a legacy PicketBox SecurityDomain, and then reloaded… Affected: 7.0 |
| CVE-2020-14307 | 6.5 | Jul 24 | A vulnerability was found in Wildfly's Enterprise Java Beans (EJB) versions shipped with Red Hat JBoss EAP 7, where SessionOpenInvocations are never removed from the remote… Affected: 7.0 |
| CVE-2020-14297 | 6.5 | Jul 24 | A flaw was discovered in Wildfly's EJB Client as shipped with Red Hat JBoss EAP 7, where some specific EJB transaction objects may get accumulated over the time and can cause… Affected: 7.0 |
| CVE-2019-14900 | 6.5 | Jul 6 | A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1 Affected: All versions, or not specified |
| CVE-2020-10719 | 6.5 | May 26 | A flaw was found in Undertow in versions before 2.1.1.Final, regarding the processing of invalid HTTP requests with large chunk sizes Affected: All versions, or not specified |
| CVE-2016-8629 | 6.5 | Mar 12 | Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server Affected: 7.1; 7.2 |
| CVE-2023-1932 | 6.1 | Nov 7 | A flaw was found in hibernate-validator's 'isValid' method in the org.hibernate.validator.internal.constraintvalidators.hv.SafeHtmlValidator class, which can be bypassed by… Affected: 7.0 |
| CVE-2024-8883 | 6.1 | Sep 19 | A misconfiguration flaw was found in Keycloak Affected: 7.6 |
| CVE-2023-6927 | 6.1 | Dec 18 | A flaw was found in Keycloak Affected: 7.0 |
| CVE-2022-4137 | 6.1 | Sep 25 | A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling Affected: 7.6 |
| CVE-2022-4361 | 6.1 | Jul 7 | Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers Affected: 7.6 before 7.6.4 |
| CVE-2022-2237 | 6.1 | Mar 27 | A flaw was found in the Keycloak Node.js Adapter Affected: 7.0 |
| CVE-2020-10748 | 6.1 | Sep 16 | A flaw was found in Keycloak's data filter, in version 10.0.1, where it allowed the processing of data URLs in some circumstances Affected: before 7.4.1 |
| CVE-2019-10219 | 6.1 | Nov 8 | A vulnerability was found in Hibernate-Validator Affected: All versions, or not specified |
| CVE-2023-48795 | 5.9 | Dec 18 | The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some… Affected: 7.0 |
| CVE-2021-3629 | 5.9 | May 24 | A flaw was found in Undertow Affected: All versions, or not specified |
| CVE-2021-3597 | 5.9 | May 24 | A flaw was found in undertow Affected: All versions, or not specified |
| CVE-2017-2585 | 5.9 | Mar 12 | Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the… Affected: 7.1; 7.2 |
| CVE-2026-4366 | 5.8 | Mar 18 | Keycloak-services: blind server-side request forgery (ssrf) via http redirect handling in keycloak Affected: 7.0 |
| CVE-2019-10157 | 5.5 | Jun 12 | It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout Affected: before 7.3.2 |
| CVE-2026-16093 | 5.4 | Jul 17 | Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers Affected: 7.0 |
| CVE-2023-6134 | 5.4 | Dec 14 | A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token Affected: before 7.6 |
| CVE-2022-1274 | 5.4 | Mar 29 | A flaw was found in Keycloak in the execute-actions-email endpoint Affected: 7.6 before 7.6.2 |
| CVE-2022-0225 | 5.4 | Aug 26 | A flaw was found in Keycloak Affected: 7.0 |
| CVE-2020-1697 | 5.4 | Feb 10 | It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored… Affected: 7.3 |
| CVE-2019-3872 | 5.4 | Jun 12 | It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x Affected: 7.0 |
| CVE-2018-10934 | 5.4 | Mar 27 | A cross-site scripting (XSS) vulnerability was found in the JBoss Management Console versions before 7.1.6.CR1, 7.1.6.GA Affected: 7.2 |
| CVE-2018-14655 | 5.4 | Nov 13 | A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final Affected: 7.2; 7.2 |
| CVE-2018-10894 | 5.4 | Aug 1 | It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates Affected: 7.2 |
| CVE-2017-12158 | 5.4 | Oct 26 | It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations Affected: 7.0; 7.1 |
| CVE-2021-3754 | 5.3 | Aug 26 | A flaw was found in keycloak where an attacker is able to register himself with the username same as the email ID of any existing user Affected: 7.0 |
| CVE-2021-3424 | 5.3 | Jun 1 | A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible Affected: 7.4 |
| CVE-2020-1710 | 5.3 | Sep 16 | The issue appears to be that JBoss EAP 6.4.21 does not parse the field-name in accordance to RFC7230[1] as it returns a 200 instead of a 400 Affected: All versions, or not specified |
| CVE-2023-0264 | 5.0 | Aug 4 | A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests Affected: before 7.6.2; before 7.6.2 |
| CVE-2022-2764 | 4.9 | Sep 1 | A flaw was found in Undertow Affected: 7.0 |