Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
89 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A Privilege Escalation vulnerability was identified in the Keycloak identity and access management solution, specifically when FGAPv2 is enabled in version 26.2.x. The flaw lies in the admin permission enforcement logic, where a user with manage-users privileges can self-assign realm-admin rights. The escalation occurs due to missing privilege boundary checks in role mapping operations via the admin REST interface. A malicious administrator with limited permissions can exploit this by editing their own user roles, gaining unauthorized full access to realm configuration and user data. This issue has been fixed in versions 26.2.6, and 26.3.0.
Recommended action: Upgrade to 26.2.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
There is a flaw with the first login flow where, during a IdP login, an attacker with a registered account can initiate the process to merge accounts with an existing victim's account. The attacker will subsequently be prompted to "review profile" information, which allows the the attacker to modify their email address to that of a victim's account. This triggers a verification email sent to the victim's email address. If the victim clicks the verification link, the attacker can gain access to the victim's account. While not a zero-interaction attack, the attacker's email address is not directly present in the verification email content, making it a potential phishing opportunity. This issue has been fixed in versions 26.0.13, 26.2.6, and 26.3.0.
Recommended action: Upgrade to 26.2.6 or 26.0.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in Keycloak. The org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to circumvent requirements such as setting up two-factor authentication.
Recommended action: Upgrade to 26.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in Keycloak. By setting a verification policy to 'ANY', the trust store certificate verification is skipped, which is unintended.
Recommended action: Upgrade to 26.2.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
This vulnerability is caused by the improper mapping of users to organizations based solely on email/username patterns. The issue is limited to the token claim level, meaning the user is not truly added to the organization but may appear as such in applications relying on these claims. The risk increases in scenarios where self-registration is enabled and unrestricted, allowing an attacker to exploit the naming pattern. The issue is mitigated if admins restrict registration or use strict validation mechanisms.
Recommended action: Upgrade to 26.1.3 or 26.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A vulnerability was found in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.
Recommended action: Upgrade to 26.0.6 or 24.0.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks the current session before authentication to trigger session fixation.
Recommended action: Upgrade to 25.0.5, 24.0.7 or 22.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost/ or http://127.0.0.1/, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.
Recommended action: Upgrade to 25.0.6, 24.0.8 or 22.0.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
If an attacker launches many login attempts in parallel then the attacker can have more guesses at a password than the brute force protection configuration permits. This is due to the brute force check occurring before the brute force protector has locked the user. Acknowledgements: Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
Recommended action: Upgrade to 25.0.4, 24.0.7 or 22.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In any realm set with "User (Self) registration" a user that is registered with a username in email format can be "locked out" (denied from logging in) using his username.
Recommended action: Upgrade to 24.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Keycloak allows the use of email as a username and doesn't check that an account with this email already exists. That could lead to the unability to reset/login with email for the user. This is caused by usernames being evaluated before emails.
Recommended action: Upgrade to 24.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Users with low privileges (just plain users in the realm) are able to utilize administrative functionalities within Keycloak admin interface. This issue presents a significant security risk as it allows unauthorized users to perform actions reserved for administrators, potentially leading to data breaches or system compromise. Acknowledgements: Special thanks to Maurizio Agazzini for reporting this issue and helping us improve our project.
Recommended action: Upgrade to 24.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in Keycloak in the OAuth 2.0 Pushed Authorization Requests (PAR). Client provided parameters were found to be included in plain text in the KCRESTART cookie returned by the authorization server's HTTP response to a requesturi authorization request. This could lead to an information disclosure vulnerability.
Recommended action: Upgrade to 24.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Keycloak was found to not properly enforce token types when validating signatures locally. An authenticated attacker could use this flaw to exchange a logout token for an access token and possibly gain access to data outside of enforced permissions.
Recommended action: Upgrade to 24.0.3 or 22.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in Keycloak. An active keycloak session can be hijacked by initiating a new authentication (having the query parameter prompt=login) and forcing the user to enter his credentials once again. If the user cancels this re-authentication by clicking Restart login, the account takeover could take place as the new session, with a different SUB, will have the same SID as the previous session.
Recommended action: Upgrade to 24.0.3 or 22.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field. Acknowledgements: Special thanks to Axel Flamcourt for reporting this issue and helping us improve our project.
Recommended action: Upgrade to 24.0.3 or 22.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A potential security flaw in the "checkLoginIframe" which allows unvalidated cross-origin messages, enabling potential DDoS attacks. By exploiting this vulnerability, attackers could coordinate to send millions of requests in seconds using simple code, significantly impacting the application's availability without proper origin validation for incoming messages. Acknowledgements Special thanks to Adriano Márcio Monteiro from BRZTEC for reporting this issue and helping us improve our project.
Recommended action: Upgrade to 24.0.3 or 22.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection. Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping us improve our security.
Recommended action: Upgrade to 23.0.5 or 22.0.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized. Acknowledgements: Special thanks to Bastian Kanbach for reporting this issue and helping us improve our security.
Recommended action: Upgrade to 24.0.3 or 22.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Keycloak allows arbitrary URLs as SAML Assertion Consumer Service POST Binding URL (ACS), including JavaScript URIs (javascript:). Allowing JavaScript URIs in combination with HTML forms leads to JavaScript evaluation in the context of the embedding origin on form submission. Acknowledgements: Special thanks to Lauritz Holtmann for reporting this issue and helping us improve our project.
Recommended action: Upgrade to 24.0.3 or 22.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication.
Recommended action: Upgrade to 24.0.3 or 22.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was found in the redirecturi validation logic that allows for a bypass of otherwise explicitly allowed hosts.
Recommended action: Upgrade to 24.0.3 or 22.0.10 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An issue was found in the redirecturi validation logic that allows for a bypass of otherwise explicitly allowed hosts. The problem arises in the verifyRedirectUri method, which attempts to enforce rules on user-controllable input, but essentially causes a desynchronization in how Keycloak and browsers interpret URLs. Keycloak, for example, receives "www%2ekeycloak%2eorg%2fapp%2f:y@example.com" and thinks the authority to be keycloak.org when it is actually example.com. This happens because the validation logic is performed on a URL decoded version, which no longer represents the original input. Acknowledgements Karel Knibbe
Recommended action: Upgrade to 23.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Keycloak prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This could permit an attacker to submit a specially crafted request leading to XSS or possibly further attacks.
Recommended action: Upgrade to 23.0.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in the Keycloak package. This flaw allows an attacker to benefit from an LDAP query and access existing usernames in the server.
Recommended action: Upgrade to 23.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.