Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

98 records

Vendor: Red Hat Component: Keycloak Clear all filters
TI-2025-04865 CVE-2025-5416 · GHSA-vf3w-mcmx-rx83

Keycloak-core: keycloak environment information

Priority LOW 13

A vulnerability has been identified in Keycloak that could lead to unauthorized information disclosure.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00273 Published 2025-06-20 Fix deferred CWE-497
TI-2023-06246 CVE-2023-6841 · GHSA-w97f-w3hq-36g2

Keycloak: amount of attributes per object is not limited and it may lead to dos

Priority MEDIUM 40

A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send b…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00736 Published 2024-09-10 Partial fix · 24.0.0 CWE-231
TI-2024-06725 CVE-2024-7260 · GHSA-g4gc-rh26-m3p5

Keycloak-core: open redirect on account page

Priority LOW 28

An open redirect vulnerability was found in Keycloak.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00579 Published 2024-09-09 Fixed in 24.0.7, 24.0.7-4 +1 CWE-601
TI-2023-06202 CVE-2023-6787 · GHSA-c9h6-v78w-52wj

Keycloak: session hijacking via re-authentication

Priority LOW 39

A flaw was found in Keycloak that occurs from an error in the re-authentication mechanism within org.keycloak.authentication.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00744 Published 2024-04-25 Partial fix · 22.0.10, 24.0.3 +3 CWE-287
TI-2024-01049 CVE-2024-1132 · GHSA-72vp-xfrc-42xm

Keycloak: path transversal in redirection validation

Priority HIGH 70

A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01552 Published 2024-04-17 Partial fix · 22.0.10, 24.0.3 +12 CWE-22
TI-2024-01601 CVE-2024-1722 · GHSA-cq42-vhv7-xr7p

Keycloak-core: dos via account lockout

Priority LOW 25

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00771 Published 2024-02-27 Partial fix · 24.0.0 CWE-645
TI-2023-05774 CVE-2023-6291 · GHSA-mpwq-j3xf-7m5w

Keycloak: redirect_uri validation bypass

Priority LOW 33

A flaw was found in the redirect_uri validation logic in Keycloak.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.0095 Published 2024-01-26 Partial fix · 22.0.7-1, 22-6 +11 CWE-601
TI-2023-26623 CVE-2023-48795 · GHSA-45x7-px36-x8w8

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6…

Priority HIGH 70

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.93547 Published 2023-12-18 Partial fix · 0.40.2, 0.17.0 +2 CWE-354
TI-2023-05639 CVE-2023-6134 · GHSA-cvg2-7c3j-g36j

Keycloak: reflected xss via wildcard in oidc redirect_uri

Priority LOW 27

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01318 Published 2023-12-14 Fixed in 22.0.7-1, 22-6 +11 CWE-79
TI-2023-06014 CVE-2023-6563 · GHSA-54f3-c6hg-865h

Keycloak: offline session token dos

Priority LOW 36

An unconstrained memory consumption vulnerability was discovered in Keycloak.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.01239 Published 2023-12-14 Fixed in 18.0.11-2.redhat_00003.1.el7sso, 18.0.11-2.redhat_00003.1.el8sso +4 CWE-770
TI-2023-02276 CVE-2023-2422 · GHSA-3qh5-qqj2-c78f

Keycloak: oauth client impersonation

Priority LOW 32

A flaw was found in Keycloak.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00522 Published 2023-10-04 Fixed in 18.0.8-1.redhat_00001.1.el7sso, 18.0.8-1.redhat_00001.1.el8sso +3 CWE-295
TI-2022-03783 CVE-2022-4137 · GHSA-9hhc-pj4w-w5rv

Keycloak: reflected xss attack

Priority LOW 38

A reflected cross-site scripting (XSS) vulnerability was found in the 'oob' OAuth endpoint due to incorrect null-byte handling.

CVSS 3.1HIGH 8.1 Network No auth User interaction EPSS 0.01193 Published 2023-09-25 Fixed in 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso +2 CWE-81
TI-2022-03591 CVE-2022-3916 · GHSA-97g8-xfvw-q4hg

Keycloak: session takeover with oidc offline refreshtokens

Priority LOW 34

A flaw was found in the offline_access scope in Keycloak.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00952 Published 2023-09-20 Fixed in 18.0.3-1.redhat_00002.1.el7sso, 18.0.6-1.redhat_00001.1.el7sso +7 CWE-384
TI-2023-04529 CVE-2023-4918 · GHSA-5q66-v53q-pm35

Plaintext storage of user password

Priority MEDIUM 41

A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00574 Published 2023-09-12 Fixed in 22.0.3 CWE-256
TI-2023-00250 CVE-2023-0264 · GHSA-9g98-5mj6-f9mv

Improper authentication in Red Hat Keycloak

Priority LOW 25

A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.01274 Published 2023-08-04 Fixed in 18.0.6, 21.0.1 CWE-287
TI-2022-03994 CVE-2022-4361 · GHSA-3p62-6fjh-3p5h

Cross-site scripting in keycloak

Priority MEDIUM 50

Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00691 Published 2023-07-07 Fixed in 21.1.2 CWE-81
Load more