Vulnerabilities

search
ID
Packages
Summary
Published
arrow_upward
Attributes
GHSA-q4xq-445g-g6ch
  • Maven/org.keycloak:keycloak-core
 Keycloak allows cross-site scripting (XSS) 18 Feb 2025
  • No fix available
  • Severity - 3.8 (Low)
GHSA-93ww-43rr-79v3
  • Maven/org.keycloak:keycloak-core
 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination 25 Nov 2024
  • Fix available
  • Severity - 7.1 (High)
GHSA-xmmm-jw76-q7vg
  • Maven/org.keycloak:keycloak-core
 Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity 14 Oct 2024
  • Fix available
  • Severity - 6.3 (Medium)
GHSA-w97f-w3hq-36g2
  • Maven/org.keycloak:keycloak-core
 Keycloak Denial of Service vulnerability 10 Sep 2024
  • Fix available
  • Severity - 7.1 (High)
GHSA-g4gc-rh26-m3p5
  • Maven/org.keycloak:keycloak-core
 Keycloak Open Redirect vulnerability 09 Sep 2024
  • Fix available
  • Severity - 4.8 (Medium)
GHSA-9vm7-v8wj-3fqw
  • Maven/org.keycloak:keycloak-core
 keycloak-core: open redirect via "form_post.jwt" JARM response mode 23 Jan 2024
  • Fix available
  • Severity - 4.6 (Medium)
GHSA-5q66-v53q-pm35
  • Maven/org.keycloak:keycloak-core
 Keycloak vulnerable to Plaintext Storage of User Password 12 Sep 2023
  • Fix available
  • Severity - 8.8 (High)
GHSA-c7xw-p58w-h6fj
  • Maven/org.keycloak:keycloak-core
 Keycloak: Impersonation and lockout possible through incorrect handling of email trust 18 Jul 2023
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-5cc8-pgp5-7mpm
  • Maven/org.keycloak:keycloak-core
 Keycloak Untrusted Certificate Validation vulnerability 30 Jun 2023
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-v436-q368-hvgg
  • Maven/org.keycloak:keycloak-core
 Keycloak has lack of validation of access token on client registrations endpoint 12 Jan 2023
  • Fix available
  • Severity - 6.5 (Medium)
GHSA-755v-r4x4-qf7m
  • Maven/org.keycloak:keycloak-core
 Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown 29 Nov 2022
  • Fix available
GHSA-3w4v-rvc4-2xpw
  • Maven/org.keycloak:keycloak-core
 Keycloak has Files or Directories Accessible to External Parties 27 Aug 2022
  • Fix available
  • Severity - 4.3 (Medium)
GHSA-qpq9-jpv4-6gwr
  • Maven/org.keycloak:keycloak-core
 Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow 27 Aug 2022
  • Fix available
  • Severity - 7.5 (High)
GHSA-fqc7-5xxc-ph7r
  • Maven/org.keycloak:keycloak-core
 Keycloak XSS via use of malicious payload as group name when creating new group from admin console 27 Aug 2022
  • No fix available
  • Severity - 5.4 (Medium)
GHSA-rpj2-w6fr-79hc
  • Maven/org.keycloak:keycloak-core
 Keycloak vulnerable to Improper Certificate Validation 24 Aug 2022
  • Fix available
  • Severity - 5.4 (Medium)
GHSA-pcv5-m2wh-66j3
  • Maven/org.keycloak:keycloak-core
 Keycloak discloses information without authentication 24 May 2022
  • Fix available
  • Severity - 6.5 (Medium)
Load more...