keycloak vulnerabilities (Bitnami)
69 vulnerabilities.
-
keycloakBitnami Keycloak-services: keycloak-services: predictable account-linking hash enables account takeover via malicious oidc client 7.3 High -
keycloakBitnami Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass 9.1 Critical -
keycloakBitnami Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation 8.8 High -
keycloakBitnami Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction 7.4 High -
keycloakBitnami Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text 6.5 Medium -
keycloakBitnami Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary 5.4 Medium -
keycloakBitnami Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers 8.1 High -
keycloakBitnami Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher 8.1 High -
keycloakBitnami Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation 7.4 High -
keycloakBitnami Keycloak-services: keycloak-services: client access-type policy condition bypass during client update 6.5 Medium -
keycloakBitnami Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes 6.5 Medium -
keycloakBitnami Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation 6.6 Medium -
keycloakBitnami Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed 5.4 Medium -
keycloakBitnami Keycloak-services: keycloak-services: oidc redirect_uri fragment bypass in http parameter pollution check 3.4 Low -
keycloakBitnami Keycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction 6.8 Medium -
keycloakBitnami Keycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints 4.9 Medium -
keycloakBitnami Keycloak-services: keycloak-services: microsoft external access-token exchange bypasses configured tenant 6.8 Medium -
keycloakBitnami Keycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero 4.2 Medium -
keycloakBitnami Keycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations 5.5 Medium -
keycloakBitnami Keycloak-services: keycloak-services: information disclosure via role-users endpoint bypasses per-user view filter 6.5 Medium -
keycloakBitnami Keycloak-services: keycloak-services: vault-resolved rotated client secrets leaked via admin rest api 5.5 Medium -
keycloakBitnami Keycloak-services: keycloak-services: authenticator config endpoint exposes raw recaptcha secrets to view-only admins 4.3 Medium -
keycloakBitnami Keycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles 4.9 Medium -
keycloakBitnami Keycloak-services: keycloak-services: realm default-group reads disclose hidden groups under fgap v2 4.3 Medium -
keycloakBitnami Keycloak-services: keycloak-services: required signed-jwt assertion policy can be bypassed with unsigned assertion headers 5.4 Medium -
keycloakBitnami Keycloak-services: keycloak-services: authorization codes can be retargeted to another client session 5.4 Medium -
keycloakBitnami Keycloak-services: keycloak-services: organization invitation link exposure allows unauthorized member creation 4.9 Medium -
keycloakBitnami Keycloak-services: keycloak-services: group hierarchy search discloses hidden parent groups under fgap v2 4.3 Medium -
keycloakBitnami Org.keycloak/keycloak-quarkus-server: keycloak: unauthorized access via jwt authorization grant with disabled users 8.1 High -
keycloakBitnami Keycloak-services: keycloak: fgap v2 parent group children endpoint bypasses per-child view permission filter 4.3 Medium -
keycloakBitnami Keycloak-services: keycloak-services: fgap v2 client scope assignment bypass via clientresource 5.4 Medium -
keycloakBitnami Keycloak-services: keycloak-services: keycloak: fgap v2 role groups endpoint discloses hidden group metadata without group view permission 4.3 Medium -
keycloakBitnami Org.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion 8.1 High -
keycloakBitnami Keycloak: keycloak: information disclosure through arbitrary filesystem path probing 4.9 Medium -
keycloakBitnami Keycloak: keycloak: unauthorized access to resources via uma permission ticket bypass 4.6 Medium -
keycloakBitnami Keycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token 6.5 Medium -
keycloakBitnami Keycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass 7.3 High -
keycloakBitnami Keycloak: group-admin escalation to realm-admin 7.7 High -
keycloakBitnami Keycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison 8.1 High -
keycloakBitnami Keycloak-rest-admin-ui-ext: authorization bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of keycloak 4.9 Medium -
keycloakBitnami Keycloak: keycloak: access token disclosure and implicit flow bypass via forged client data 7.1 High -
keycloakBitnami Org.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover 7.5 High -
keycloakBitnami Org.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak 8.1 High -
keycloakBitnami Keycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay 6.8 Medium -
keycloakBitnami Keycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass 6.5 Medium -
keycloakBitnami Keycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api 4.9 Medium -
keycloakBitnami Keycloak: keycloak: denial of service via specially crafted saml input 7.5 High -
keycloakBitnami Keycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint 4.3 Medium -
keycloakBitnami Keycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference 6.8 Medium -
keycloakBitnami Keycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources. 8.1 High - Show olderLoading…