Redhat Keycloak vulnerabilities

CVE-2020-1728 [MEDIUM] CWE-358 CVE-2020-1728: A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing general HTTP security headers in HTTP-responses. This does not directly lead to a security issue, yet it might aid attackers in their efforts to exploit other problems. The flaws unnecessarily make the servers more

CVE-2020-1698 [MEDIUM] CWE-200 CVE-2020-1698: A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class ma A flaw was found in keycloak in versions before 9.0.0. A logged exception in the HttpMethod class may leak the password given as parameter. The highest threat from this vulnerability is to data confidentiality.

CVE-2020-1694 [MEDIUM] CWE-183 CVE-2020-1694: A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.

CVE-2022-4361 [MEDIUM] CWE-81 CVE-2022-4361: Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) v Keycloak, an open-source identity and access management solution, has a cross-site scripting (XSS) vulnerability in the SAML or OIDC providers. The vulnerability can allow an attacker to execute malicious scripts by setting the AssertionConsumerServiceURL value or the redirect_uri.

CVE-2020-1697 [MEDIUM] CWE-79 CVE-2020-1697: It was found in all keycloak versions before 9.0.0 that links to external applications (Application It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not validated properly and could allow Stored XSS attacks. An authed malicious user could create URLs to trick users in other realms, and possibly conduct further attacks.

CVE-2020-10686 [MEDIUM] CWE-285 CVE-2020-10686: A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. The attacker could then use the remove devices form to post different credential IDs and possibly remove MFA devices for other users.

CVE-2021-3856 [MEDIUM] CWE-552 CVE-2021-3856: ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a re ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.

CVE-2020-10776 [MEDIUM] CWE-79 CVE-2020-10776: A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for t A flaw was found in Keycloak before version 12.0.0, where it is possible to add unsafe schemes for the redirect_uri parameter. This flaw allows an attacker to perform a Cross-site scripting attack.

CVE-2019-3875 [MEDIUM] CWE-295 CVE-2019-3875: A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verificatio A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http

CVE-2020-1724 [MEDIUM] CWE-613 CVE-2020-1724: A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is cur A flaw was found in Keycloak in versions before 9.0.2. This flaw allows a malicious user that is currently logged in, to see the personal information of a previously logged out user in the account manager section.

CVE-2019-14820 [MEDIUM] CWE-200 CVE-2019-14820: It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.c It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.

CVE-2020-27826 [MEDIUM] CWE-250 CVE-2020-27826: A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadat A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.

CVE-2018-14658 [MEDIUM] CWE-601 CVE-2018-14658: A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not n A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack

CVE-2019-10157 [MEDIUM] CWE-345 CVE-2019-10157: It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web to It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An attacker with local access could use this to construct a malicious web token setting an NBF parameter that could prevent user access indefinitely.

CVE-2018-10912 [MEDIUM] CWE-835 CVE-2018-10912: keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycl keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.

CVE-2014-3652 [MEDIUM] CWE-601 CVE-2014-3652: JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL. JBoss KeyCloak: Open redirect vulnerability via failure to validate the redirect URL.

CVE-2014-3655 [MEDIUM] CWE-352 CVE-2014-3655: JBoss KeyCloak is vulnerable to soft token deletion via CSRF JBoss KeyCloak is vulnerable to soft token deletion via CSRF

CVE-2025-12150 [LOW] CWE-347 CVE-2025-12150: A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacke A flaw was found in Keycloak’s WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authenticat

CVE-2019-3868 [LOW] CWE-200 CVE-2019-3868: Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the se Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an attacker with access to service provider backend could hijack user’s browser session.

CVE-2020-1717 [LOW] CWE-209 CVE-2020-1717: A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack. A flaw was found in Keycloak 7.0.1. A logged in user can do an account email enumeration attack.