org.keycloak:keycloak-services

vulnerable: 1.0-alpha-1 ... 9.0.3 (219 versions)

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationDat…

vulnerable: 1.0-alpha-1 ... 9.0.3 (216 versions)

A flaw was found in Keycloak. A vulnerability exists in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism (lookupIdentityProviderFr…

vulnerable: 26.3.0 ... 26.4.7 (14 versions)

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verificati…

vulnerable: 1.0-alpha-1 ... 9.0.3 (220 versions)

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits…

vulnerable: 1.0-alpha-1 ... 9.0.3 (221 versions)

A flaw was found in Keycloak. A remote attacker could bypass security controls by sending a valid SAML response from an external Identity Provider (IdP) to the Keycloak SAML endpoint for IdP-initiated broker logins. This allows the attacke…

vulnerable: 1.0-alpha-1 ... 9.0.3 (220 versions)

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting…

vulnerable: 1.0-alpha-1 ... 9.0.3 (222 versions)

A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain contr…

vulnerable: 1.0-alpha-1 ... 9.0.3 (222 versions)

A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server c…

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtain…

vulnerable: 1.0-alpha-1 ... 9.0.3 (224 versions)

A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the `azp` claim from a clien…

vulnerable: 1.0-alpha-1 ... 9.0.3 (226 versions)

A flaw was found in Keycloak. A low-privilege administrator with the 'view-clients' role can exploit this by invoking the 'evaluate-scopes' Admin API endpoints with an arbitrary user ID (userId) parameter. This vulnerability allows for cro…

vulnerable: 1.0-alpha-1 ... 9.0.3 (226 versions)

A flaw was found in Keycloak. This access control vulnerability in Keycloak's OpenID Connect (OIDC) token introspection endpoint allows a confidential client to bypass audience restrictions. An attacker-controlled client with valid credent…

vulnerable: 1.0-alpha-1 ... 9.0.3 (222 versions)

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. T…

vulnerable: 1.0-alpha-1 ... 9.0.3 (226 versions)

A flaw was found in Keycloak. This authentication vulnerability allows a remote attacker to replay `ExecuteActionsActionToken` tokens within Keycloak's WebAuthn (Web Authentication) flow. By intercepting an execute-actions email link, an a…

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to …

vulnerable: 1.0-alpha-1 ... 9.0.3 (222 versions)

A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes …

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can…

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of co…

vulnerable: 1.0-alpha-1 ... 9.0.3 (216 versions)

Keycloak's identity-first login flow exposes user information A flaw was found in Keycloak. A remote attacker can exploit differential error messages during the identity-first login flow when Organizations are enabled. This vulnerability …

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high r…

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation req…

vulnerable: 1.0-alpha-1 ... 9.0.3 (225 versions)

A flaw was found in Keycloak. An authenticated attacker can perform Server-Side Request Forgery (SSRF) by manipulating the `client_session_host` parameter during refresh token requests. This occurs when a Keycloak client is configured to u…

vulnerable: 1.0-alpha-1 ... 9.0.3 (226 versions)

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write…

vulnerable: 1.0-alpha-1 ... 9.0.3 (226 versions)

A flaw was found in Keycloak's URL validation logic during redirect operations. By crafting a malicious request, an attacker could bypass validation to redirect users to unauthorized URLs, potentially leading to the exposure of sensitive i…

vulnerable: 1.0-alpha-1 ... 9.0.3 (226 versions)

A session fixation vulnerability was found in Keycloak's login-actions endpoints. An unauthenticated attacker could exploit this flaw by pre-creating an authentication session and tricking a victim into visiting a maliciously crafted link.…

vulnerable: 1.0-alpha-1 ... 9.0.3 (226 versions)

A flaw was found in Keycloak. A low-privilege user, with knowledge of user credentials and client ID, can bypass a security control intended to disable the implicit flow in OpenID Connect (OIDC) clients. By manipulating client data during …

vulnerable: 1.0-alpha-1 ... 9.0.3 (227 versions)

A flaw was found in Keycloak. An authenticated user can bypass configured WebAuthn policies during credential registration by manipulating client-side JavaScript. This occurs because the server-side processAction() fails to validate that t…

vulnerable: 1.0-alpha-1 ... 9.0.3 (227 versions)

A flaw was found in Keycloak. When both realm-level and client-level `notBefore` revocation policies are configured, Keycloak's OpenID Connect (OIDC) Introspection feature fails to properly honor the realm-level policy. This allows tokens …

vulnerable: 1.0-alpha-1 ... 9.0.3 (227 versions)

A flaw was found in Keycloak. The cross-session verification proof is keyed only by (local userId, idpAlias) and is not bound to the upstream identity that was actually verified, so a second upstream account on the same IdP can consume it …