Read the docs
Red Hat Security Advisory

RHSA-2024:1867

Red Hat build of Keycloak 22.0.10 enhancement and security update

Released 2024-04-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 9 records

TI-2024-01049 CVE-2024-1132 · GHSA-72vp-xfrc-42xm

Keycloak: path transversal in redirection validation

Priority HIGH 70

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01552 Published 2024-04-17 Partial fix · 22.0.10, 24.0.3 +12 CWE-22
TI-2023-06202 CVE-2023-6787 · GHSA-c9h6-v78w-52wj

Keycloak: session hijacking via re-authentication

Priority LOW 39

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00744 Published 2024-04-25 Partial fix · 22.0.10, 24.0.3 +3 CWE-287
TI-2023-06139 CVE-2023-6717 · GHSA-8rmm-gm28-pj8q

Keycloak: xss via assertion consumer service url in saml post-binding flow

Priority LOW 30

A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (X…

CVSS 3.1MEDIUM 6.0 Network High privileges User interaction EPSS 0.00711 Published 2024-04-25 Partial fix · 22.0.10, 24.0.3 +5 CWE-79
TI-2023-05996 CVE-2023-6544 · GHSA-46c8-635v-68r2

Keycloak: authorization bypass

Priority LOW 27

A flaw was found in the Keycloak package.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.01075 Published 2024-04-25 Fixed in 22.0.10, 24.0.3 +7 CWE-625
TI-2023-03357 CVE-2023-3597 · GHSA-4f53-xh3v-g8x4

Keycloak: secondary factor bypass in step-up authentication

Priority LOW 24

A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.00603 Published 2024-04-25 Fixed in 22.0.10, 24.0.3 +3 CWE-287