org.keycloak:keycloak-services vulnerabilities (Maven)
104 vulnerabilities.
org.keycloak:keycloak-servicesMavenKeycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass9.1 Criticalorg.keycloak:keycloak-servicesMavenOrg.keycloak:keycloak-services: keycloak: authentication bypass via jwt algorithm confusion8.1 Highorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: information disclosure through arbitrary filesystem path probing4.9 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: unauthorized access to resources via uma permission ticket bypass4.6 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: attacker can re-enable and take over disabled clients via registration access token6.5 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: cross-site scripting (xss) via case-insensitive uri validation bypass7.3 Highorg.keycloak:keycloak-servicesMavenKeycloak-policy-enforcer: keycloak policy enforcer: authorization bypass via incorrect uri comparison8.1 Highorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: information disclosure due to user profile permission bypass2.7 Loworg.keycloak:keycloak-servicesMavenKeycloak: keycloak: denial of service via malformed authorization header5.3 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster restart6.8 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: brute-force protection bypass in ciba flow4.3 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: privilege escalation via improper scope mapping enforcement7.3 Highorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: information disclosure via saml ecp endpoint5.3 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition6.5 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: security policy bypass in jwe-encrypted request object processing5.9 Mediumorg.keycloak:keycloak-servicesMavenKeycloak-rhel9: organization data leak after feature disabled in keycloak4.3 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: privilege escalation due to oversized subject_token jwt6.8 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: org.keycloak.protocol.oidc: http parameter pollution in oidc redirect uri allows response parameter duplication - #ghi-6044.2 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: cross-session email verification proof not bound to upstream identity in first-broker-login6.4 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: access token disclosure and implicit flow bypass via forged client data7.1 Highorg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: session fixation in oidc login flow that can lead to account takeover7.5 Highorg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: open redirect when using wildcard valid redirect uris in keycloak8.1 Highorg.keycloak:keycloak-servicesMavenKeycloak: org.keycloak.authentication: keycloak: unauthorized account takeover via webauthn token replay6.8 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: information disclosure via oidc token introspection endpoint audience bypass6.5 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: org.keycloak.services: keycloak: information disclosure via evaluate-scopes admin api4.9 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: org.keycloak.authorization: keycloak: information disclosure via broken access control in user lookup endpoint4.3 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: unauthorized resource access and data modification via insecure direct object reference6.8 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: security flaw in org.keycloak/keycloak-services5.4 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: org.keycloak/keycloak-services: keycloak: policy bypass during webauthn credential registration via client-side javascript manipulation4.3 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak.keycloak-services: improper access control on keycloak server when the account account api feature is disabled5.4 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak.forms.login: keycloak: keycloak: arbitrary code execution via stored cross-site scripting (xss) in organization selection login page6.9 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: org.keycloak.protocol.oidc.grants.ciba: keycloak: information disclosure via cors header injection due to unvalidated jwt azp claim3.7 Loworg.keycloak:keycloak-servicesMavenKeycloak: keycloak: uma policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.8.1 Highorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: denial of service via excessive processing of openid connect scope parameters7.5 Highorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: replay of action tokens via improper handling of single-use entries5.3 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: privilege escalation via forged authorization codes due to singleuseobjectprovider isolation flaw7.4 Highorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: information disclosure due to redirect_uri validation bypass7.3 Highorg.keycloak:keycloak-servicesMavenKeycloak: org.keycloak/keycloak-services: keycloak: privilege escalation via manage-clients permission6.5 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: information disclosure via improper role enforcement in uma 2.0 protection api4.3 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak.protocol.oidc.grants: org.keycloak.services.managers: keycloak: server-side request forgery via oidc token endpoint manipulation3.1 Loworg.keycloak:keycloak-servicesMavenKeycloak: keycloak: user enumeration via differential error messages3.7 Loworg.keycloak:keycloak-servicesMavenKeycloak: org.keycloak.authorization: keycloak: unauthorized resource modification due to improper access control4.3 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: denial of service due to excessive samlrequest decompression5.3 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: keycloak: unauthorized authentication via disabled saml identity provider8.1 Highorg.keycloak:keycloak-servicesMavenKeycloak-services: keycloak: unauthorized access via improper validation of encrypted saml assertions7.7 Highorg.keycloak:keycloak-servicesMavenOrg.keycloak.services.resources.account: improper access control leading to mfa deletion and account takeover in keycloak account rest api4.2 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak.services.resources.admin.userresource: keycloak: information disclosure of disabled user attributes via administrative endpoint2.7 Loworg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: improper enforcement of disabled identity provider in identitybrokerservice (authentication bypass)8.1 Highorg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: webauthn attestation statement verification bypass3.1 Loworg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: keycloak: missing check on disabled client for docker registry protocol3.8 Low- Show olderLoading…