Read the docs

Keycloak

Records22All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high7CVSS 7.0–8.9

Exploited now

Keycloak records in CISA KEV

No Keycloak vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Keycloak 5 records MEDIUM Keycloak-nodejs-auth-utils 1 record MEDIUM

Records

5 records in Keycloak · all components

TI-2017-08952 CVE-2017-12161 · GHSA-959q-32g8-vvp7

Weak password recovery in Red Hat Keycloak

Priority MEDIUM 41

It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.01308 Published 2018-02-21 Partial fix · 3.4.2.Final, 3.4.2 CWE-602
TI-2014-03024 CVE-2014-3709 · GHSA-xr6q-qqx7-553g

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak…

Priority MEDIUM 40

The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.

CVSS 3.0HIGH 8.8 Network No auth User interaction EPSS 0.00816 Published 2017-10-18 Fixed in 1.0.3.Final CWE-352
TI-2017-08950 CVE-2017-12159 · GHSA-7fmw-85qm-h22p

Insufficient session expiration in Red Hat keycloak

Priority LOW 38

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.02711 Published 2017-10-26 Fixed in 3.4.0 CWE-613
TI-2017-08949 CVE-2017-12158 · GHSA-v38p-mqq3-m6v5

Cross-site scripting in Red Hat keycloak

Priority LOW 26

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations.

CVSS 3.0MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01021 Published 2017-10-26 Partial fix · 3.4.0 CWE-444
Open these records in search →