Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
89 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
When a Keycloak server is configured to support mTLS authentication for OAuth/OpenID clients, it does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client and therefore access data that belongs to other clients.
Recommended action: Upgrade to 21.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
AssertionConsumerServiceURL is a Java implementation for SAML Service Providers (org.keycloak.protocol.saml). Affected versions of this package are vulnerable to Cross-site Scripting (XSS). AssertionConsumerServiceURL allows XSS when sending a crafted SAML XML request.
Recommended action: Upgrade to 21.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a devicecode to retrieve an access token for other OAuth clients.
Recommended action: Upgrade to 21.1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session tokens.
Recommended action: Upgrade to 21.0.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The execute-actions-email endpoint of the Keycloak Admin REST API allows a malicious actor to send emails containing phishing links to Keycloak users.
Recommended action: Upgrade to 20.0.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.
Recommended action: Upgrade to 1.1.0.Beta1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
JBoss KeyCloak is vulnerable to soft token deletion via CSRF. This issue is fixed in Keycloak 1.0.2.Final.
Recommended action: Upgrade to 1.0.2.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.
Recommended action: Upgrade to 1.0.3.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. A malicious user could use this to access unauthorized data or possibly conduct further attacks.
Recommended action: Upgrade to 4.4.0.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity.
Recommended action: Upgrade to 18.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in keycloak as shipped in Red Hat Single Sign-On 7.4 where IDN homograph attacks are possible. A malicious user can register himself with a name already registered and trick admin to grant him extra privileges.
Recommended action: Upgrade to 18.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A privilege escalation flaw was found in the token exchange feature of keycloak. Missing authorization allows a client application holding a valid access token to exchange tokens for any target client by passing the clientid of the target. This could allow a client to gain unauthorized access to additional services.
Recommended action: Upgrade to 18.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirecturi parameter. This flaw allows an attacker to perform a Cross-site scripting attack.
Recommended action: Upgrade to 12.0.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A incorrect authorization flaw was found in Keycloak 12.0.0, the flaw allows an attacker with any existing user account to create new default user accounts via the administrative REST API even where new user registration is disabled.
Recommended action: Upgrade to 15.1.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.