Vulnerabilities

TI-2022-03591 CVE-2022-3916 · GHSA-97g8-xfvw-q4hg

Keycloak: session takeover with oidc offline refreshtokens

LOW 34

A flaw was found in the offline_access scope in Keycloak.

CVSS 3.1MEDIUM 6.8 Network Low privileges No interaction EPSS 0.00952 Published 2023-09-20 Fixed in 18.0.3-1.redhat_00002.1.el7sso, 18.0.6-1.redhat_00001.1.el7sso +7 CWE-384

TI-2022-01319 CVE-2022-1438 · GHSA-w354-2f3c-qvg9

Keycloak: xss on impersonation under specific circumstances

LOW 29

A flaw was found in Keycloak.

CVSS 3.1MEDIUM 6.4 Network High privileges User interaction EPSS 0.0066 Published 2023-09-20 Fixed in 18.0.6-1.redhat_00001.1.el7sso, 18.0.6-1.redhat_00001.1.el8sso +2 CWE-79

Vulnerabilities

Filters

Keycloak: session takeover with oidc offline refreshtokens

Keycloak: xss on impersonation under specific circumstances