SS
Product
Single Sign ON
114
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 10High 47Medium 51Low 6
Watch
Add Single Sign ON to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2020-1714 | 8.8 | May 13 | A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks Affected: 7.0 |
| CVE-2019-14843 | 8.8 | Jan 7 | A flaw was found in Wildfly Security Manager, running under JDK 11 or 8, that authorized requests for any requester Affected: 7.3 |
| CVE-2019-10174 | 8.8 | Nov 25 | A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any… Affected: All versions, or not specified |
| CVE-2026-16102 | 8.1 | Aug 5 | Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers Affected: 7.0 |
| CVE-2026-15573 | 8.1 | Aug 5 | Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher Affected: 7.0 |
| CVE-2026-3009 | 8.1 | Mar 5 | Org.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass) Affected: 7.0 |
| CVE-2024-1132 | 8.1 | Apr 17 | A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect Affected: 7.6 |
| CVE-2023-2585 | 8.1 | Dec 21 | Keycloak's device authorization grant does not correctly validate the device code and client ID Affected: 7.6 |
| CVE-2020-1757 | 8.1 | Apr 21 | A flaw was found in all undertow-2.x.x SP1 versions prior to undertow-2.0.30.SP1, all undertow-1.x.x and undertow-2.x.x versions prior to undertow-2.1.0.Final, where the Servlet… Affected: 7.0 |
| CVE-2019-10201 | 8.1 | Aug 14 | It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures Affected: 7.0; 7.3.3 |
| CVE-2018-14657 | 8.1 | Nov 13 | A flaw was found in Keycloak 4.2.1.Final, 4.3.0.Final Affected: 7.2; 7.2 |
| CVE-2021-3717 | 7.8 | May 24 | A flaw was found in Wildfly Affected: All versions, or not specified |
| CVE-2020-10695 | 7.8 | May 26 | An insecure modification flaw in the /etc/passwd file was found in the redhat-sso-7 container Affected: before 7.4.4 |
| CVE-2023-6563 | 7.7 | Dec 14 | An unconstrained memory consumption vulnerability was discovered in Keycloak Affected: 7.6 |
| CVE-2025-9784 | 7.5 | Sep 2 | Undertow: undertow madeyoureset http/2 ddos vulnerability Affected: 7.0 |
| CVE-2023-6841 | 7.5 | Sep 10 | Keycloak: amount of attributes per object is not limited and it may lead to dos Affected: 7.0 |
| CVE-2024-7885 | 7.5 | Aug 21 | Undertow: improper state management in proxy protocol parsing causes information leakage Affected: 7.0 |
| CVE-2024-1635 | 7.5 | Feb 19 | Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol Affected: 7.6 |
| CVE-2023-5379 | 7.5 | Dec 12 | A flaw was found in Undertow Affected: 7.0 |
| CVE-2023-3223 | 7.5 | Sep 27 | A flaw was found in undertow Affected: 7.6 |
| CVE-2023-1108 | 7.5 | Sep 14 | A flaw was found in undertow Affected: 7.6 |
| CVE-2022-4492 | 7.5 | Feb 23 | The undertow client is not checking the server identity presented by the server certificate in https connections Affected: 7.0 |
| CVE-2022-1278 | 7.5 | Sep 13 | A flaw was found in WildFly, where an attacker can see deployment names, endpoints, and any other data the trace payload may contain Affected: 7.0 |
| CVE-2022-1319 | 7.5 | Aug 31 | A flaw was found in Undertow Affected: 7.0 |
| CVE-2022-1259 | 7.5 | Aug 31 | A flaw was found in Undertow Affected: 7.0 |
| CVE-2022-0084 | 7.5 | Aug 26 | A flaw was found in XNIO, specifically in the notifyReadClosed method Affected: 7.0 |
| CVE-2021-3859 | 7.5 | Aug 26 | A flaw was found in Undertow that tripped the client-side invocation timeout with certain calls made over HTTP2 Affected: 7.4.10; 7.5.1 |
| CVE-2021-3632 | 7.5 | Aug 26 | A flaw was found in Keycloak Affected: 7.0; 7.4 before 7.4.9 |
| CVE-2021-3690 | 7.5 | Aug 23 | A flaw was found in Undertow Affected: All versions, or not specified |
| CVE-2022-0853 | 7.5 | Mar 11 | A flaw was found in JBoss-client Affected: 7.0 |
| CVE-2021-4104 | 7.5 | Dec 14 | JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration Affected: 7.0 |
| CVE-2021-3637 | 7.5 | Jul 9 | A flaw was found in keycloak-model-infinispan in keycloak versions before 14.0.0 where authenticationSessions map in RootAuthenticationSessionEntity grows boundlessly which could… Affected: 7.0 |
| CVE-2020-25644 | 7.5 | Oct 6 | A memory leak flaw was found in WildFly OpenSSL in versions prior to 1.1.3.Final, where it removes an HTTP session Affected: 7.0 |
| CVE-2020-10758 | 7.5 | Sep 16 | A vulnerability was found in Keycloak before 11.0.1 where DoS attack is possible by sending twenty requests simultaneously to the specified keycloak server, all with a… Affected: 7.0; 7.4 |
| CVE-2019-14888 | 7.5 | Jan 23 | A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS Affected: 7.0 |
| CVE-2019-9515 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service Affected: 7.3 |
| CVE-2019-9514 | 7.5 | Aug 13 | Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service Affected: 7.3 |
| CVE-2019-10184 | 7.5 | Jul 25 | undertow before version 2.0.23.Final is vulnerable to an information leak issue Affected: 7.0; 7.3; 7.3; 7.3 |
| CVE-2018-12022 | 7.5 | Mar 17 | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 Affected: 7.3 |
| CVE-2018-12023 | 7.5 | Mar 17 | An issue was discovered in FasterXML jackson-databind prior to 2.7.9.4, 2.8.11.2, and 2.9.6 Affected: 7.3 |
| CVE-2017-12159 | 7.5 | Oct 26 | It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session Affected: 7.0; 7.1 |
| CVE-2026-3121 | 7.2 | Mar 26 | Keycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission Affected: 7.0 |
| CVE-2022-2668 | 7.2 | Aug 5 | An issue was discovered in Keycloak that allows arbitrary Javascript to be uploaded for the SAML protocol mapper even if the UPLOAD_SCRIPTS feature is disabled Affected: 7.0 |
| CVE-2024-7341 | 7.1 | Sep 9 | Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters Affected: 7.6 before 7.6.10 |
| CVE-2023-6291 | 7.1 | Jan 26 | A flaw was found in the redirect_uri validation logic in Keycloak Affected: 7.6 |
| CVE-2023-2422 | 7.1 | Oct 4 | A flaw was found in Keycloak Affected: 7.6 |
| CVE-2021-3461 | 7.1 | Apr 1 | A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute… Affected: 7.0; 7.4; 7.4.7 |
Showing 47