org.keycloak:keycloak-services vulnerabilities (Maven)
104 vulnerabilities.
org.keycloak:keycloak-servicesMavenKeycloak: incorrect ownership checks in /uma-policy/5.4 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak.services.resources.organizations: keycloak: unauthorized organization registration via improper invitation token validation8.1 Highorg.keycloak:keycloak-servicesMavenOrg.keycloak.protocol.oidc.grants: disabled identity providers are still accepted for jwt authorization grant8.8 Highorg.keycloak:keycloak-servicesMavenOrg.keycloak.services.resources.admin: keycloak: limited administrator can retrieve sensitive user attributes via admin api2.7 Loworg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: keycloak saml brokering: response delay due to unchecked notonorafter in subjectconfirmationdata3.1 Loworg.keycloak:keycloak-servicesMavenKeycloak-server: keycloak: improper access control in admin rest api leads to information disclosure2.7 Loworg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: keycloak keycloak-services: business logic flaw allows unauthorized token issuance for disabled users6.5 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak.protocol.oidc: keycloak refresh token reuse bypass via toctou race condition3.1 Loworg.keycloak:keycloak-servicesMavenKeycloak-services: keycloak admin rest api: improper access control leads to sensitive role metadata information disclosure2.7 Loworg.keycloak:keycloak-servicesMavenOrg.keycloak.protocol.oidc.endpoints.logoutendpoint: offline session takeover due to reused authentication session id6.0 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: org.keycloak:keycloak-services: user can refresh offline session even after client's offline_access scope was removed5.4 Mediumorg.keycloak:keycloak-servicesMavenKeycloak-server: too long and not settings compliant session5.4 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: keycloak smtp inject vulnerability5.3 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: privilege escalation in keycloak admin console (fgapv2 enabled)6.5 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: phishing attack via email verification step in first login flow7.1 Highorg.keycloak:keycloak-servicesMavenOrg.keycloak.authentication: two factor authentication bypass5.4 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak.protocol.services: keycloak hostname verification8.2 Highorg.keycloak:keycloak-servicesMavenOrg.keycloak/keycloak-services: jwt token cache exhaustion leading to denial of service (dos) in keycloak4.9 Mediumorg.keycloak:keycloak-servicesMavenKeycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims5.4 Mediumorg.keycloak:keycloak-servicesMavenOrg.keycloak:keycloak-services: keycloak denial of service6.5 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: vulnerable redirect uri validation results in open redirec6.1 Mediumorg.keycloak:keycloak-servicesMavenWildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters7.1 Highorg.keycloak:keycloak-servicesMavenKeycloak: potential bypass of brute force protection6.5 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: unguarded admin rest api endpoints allows low privilege users to use administrative functionalities8.1 Highorg.keycloak:keycloak-servicesMavenKeycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie7.5 Highorg.keycloak:keycloak-servicesMavenKeycloak: impersonation via logout token exchange3.4 Loworg.keycloak:keycloak-servicesMavenKeycloak: session hijacking via re-authentication6.5 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: log injection during webauthn authentication or registration5.3 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: authorization bypass5.4 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: xss via assertion consumer service url in saml post-binding flow6.0 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: secondary factor bypass in step-up authentication5.0 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: path traversal in the redirect validation7.1 Highorg.keycloak:keycloak-servicesMavenKeycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos7.4 Highorg.keycloak:keycloak-servicesMavenKeycloak: path transversal in redirection validation8.1 Highorg.keycloak:keycloak-servicesMavenKeycloak-core: dos via account lockout3.7 Loworg.keycloak:keycloak-servicesMavenKeycloak: redirect_uri validation bypass7.1 Highorg.keycloak:keycloak-servicesMavenKeycloak: reflected xss via wildcard in oidc redirect_uri4.6 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: ldap injection on username input7.5 Highorg.keycloak:keycloak-servicesMavenKeycloak: oauth client impersonation5.5 Mediumorg.keycloak:keycloak-servicesMavenKeycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC10.0 Criticalorg.keycloak:keycloak-servicesMavenKeycloak: client access via device auth request spoof3.5 Loworg.keycloak:keycloak-servicesMavenKeycloak vulnerable to user impersonation via stolen UUID code5.0 Mediumorg.keycloak:keycloak-servicesMavenHTML Injection in Keycloak Admin REST API5.4 Mediumorg.keycloak:keycloak-servicesMavenKeycloak: xss on impersonation under specific circumstances6.4 Mediumorg.keycloak:keycloak-servicesMavenKeycloak's improper input validation allows using email as username5.3 Mediumorg.keycloak:keycloak-servicesMavenKeycloak is vulnerable to IDN homograph attackNo scoreorg.keycloak:keycloak-servicesMavenKeycloak vulnerable to privilege escalation on Token Exchange feature9.8 Criticalorg.keycloak:keycloak-servicesMavenImproper Authorization in Keycloak8.8 Highorg.keycloak:keycloak-servicesMavenKeycloak is vulnerable to IDN homograph attack5.3 Mediumorg.keycloak:keycloak-servicesMavenCross-site Scripting in keycloak4.8 Medium- Show moreLoading…