org.keycloak:keycloak-core vulnerabilities (Maven)
49 vulnerabilities.
org.keycloak:keycloak-coreMavenKeycloak-core: stored xss in keycloak when creating a items in admin console3.8 Loworg.keycloak:keycloak-coreMavenKeycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination7.1 Highorg.keycloak:keycloak-coreMavenKeycloak: amount of attributes per object is not limited and it may lead to dos7.5 Highorg.keycloak:keycloak-coreMavenKeycloak-core: one time passcode (otp) is valid longer than expiration timeseverity4.8 Mediumorg.keycloak:keycloak-coreMavenKeycloak-core: open redirect on account page6.1 Mediumorg.keycloak:keycloak-coreMavenKeycloak: open redirect via "form_post.jwt" jarm response mode4.6 Mediumorg.keycloak:keycloak-coreMavenPlaintext storage of user password8.8 Highorg.keycloak:keycloak-coreMavenKeycloak Untrusted Certificate Validation vulnerability6.5 Mediumorg.keycloak:keycloak-coreMavenKeycloak: Impersonation and lockout possible through incorrect handling of email trust6.5 Mediumorg.keycloak:keycloak-coreMavenKeycloak has lack of validation of access token on client registrations endpoint3.8 Loworg.keycloak:keycloak-coreMavenStored Cross-Site Scripting (XSS) in Keycloak via groups dropdown5.4 Mediumorg.keycloak:keycloak-coreMavenKeycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow7.5 Highorg.keycloak:keycloak-coreMavenKeycloak has Files or Directories Accessible to External Parties4.3 Mediumorg.keycloak:keycloak-coreMavenKeycloak vulnerable to Improper Certificate Validation5.4 Mediumorg.keycloak:keycloak-coreMavenImproper authorization in Keycloak6.5 Mediumorg.keycloak:keycloak-coreMavenCross-site Scripting in Keycloak6.1 Mediumorg.keycloak:keycloak-coreMavenkeycloak Self Stored Cross-site Scripting vulnerability9.6 Criticalorg.keycloak:keycloak-coreMavenAuthentication Bypass in keycloak4.2 Mediumorg.keycloak:keycloak-coreMavenTemporary Directory Hijacking Vulnerability in Keycloak7.3 Highorg.keycloak:keycloak-coreMavenKeycloak Missing authentication for critical function6.8 Mediumorg.keycloak:keycloak-coreMavenKeycloak discloses information without authentication6.5 Mediumorg.keycloak:keycloak-coreMavenKeycloak vulnerable to Server-Side Request Forgery5.3 Mediumorg.keycloak:keycloak-coreMavenImproper privilege management in Keycloak8.1 Highorg.keycloak:keycloak-coreMavenImproper Input Validation in Keycloak7.5 Highorg.keycloak:keycloak-coreMavenKeycloak Insufficient Session Expiry4.3 Mediumorg.keycloak:keycloak-coreMavenKeycloak leaks sensitive information in logged exceptions5.0 Mediumorg.keycloak:keycloak-coreMavenPrivilege Defined With Unsafe Actions in Keycloak6.6 Mediumorg.keycloak:keycloak-coreMavenKeycloak users may be able to remove MFA from other users' devices4.1 Mediumorg.keycloak:keycloak-coreMavenImproper Restriction of Rendered UI Layers or Frames in Keycloak4.8 Mediumorg.keycloak:keycloak-coreMavenExposure of Sensitive Information in keycloak5.6 Mediumorg.keycloak:keycloak-coreMavenPredictable password in Keycloak9.1 Criticalorg.keycloak:keycloak-coreMavenXSS in Keycloak6.1 Mediumorg.keycloak:keycloak-coreMavenExposure of Sensitive Information to an Unauthorized Actor in Keycloak4.3 Mediumorg.keycloak:keycloak-coreMavenkeycloak vulnerable to unauthorized login via mail server setup9.1 Criticalorg.keycloak:keycloak-coreMavenJBoss KeyCloak Cross-site Scripting Vulnerability6.1 Mediumorg.keycloak:keycloak-coreMavenImproper Verification of Cryptographic Signature in keycloak8.1 Highorg.keycloak:keycloak-coreMavenImproper Input Validation and Cross-Site Request Forgery in Keycloak4.6 Mediumorg.keycloak:keycloak-coreMavenImproper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak6.5 Mediumorg.keycloak:keycloak-coreMavenExposure of Sensitive Information to an Unauthorized Actor in Keycloak3.8 Loworg.keycloak:keycloak-coreMavenImproper Authentication in Keycloak6.1 Mediumorg.keycloak:keycloak-coreMavenKeycloak Open Redirect6.1 Mediumorg.keycloak:keycloak-coreMavenImproper Authentication in org.keycloak:keycloak-core3.7 Loworg.keycloak:keycloak-coreMavenKeycloak vulnerable to infinite loop based Denial of Service7.5 Highorg.keycloak:keycloak-coreMavenkeycloak-core discloses system properties6.5 Mediumorg.keycloak:keycloak-coreMavenModerate severity vulnerability that affects org.keycloak:keycloak-core4.4 Mediumorg.keycloak:keycloak-coreMavenkeycloak-core vulnerable to timing attacks against JWS token verification5.9 Mediumorg.keycloak:keycloak-coreMavenModerate severity vulnerability that affects org.keycloak:keycloak-core6.5 Mediumorg.keycloak:keycloak-coreMavenModerate severity vulnerability that affects org.keycloak:keycloak-core8.8 Highorg.keycloak:keycloak-coreMavenKeycloak vulnerable to uncontrolled resource consumption7.5 High