maven

org.keycloak:keycloak-core

58 Total advisories

58 Vulnerabilities

0 Malware

Dependency scanning

Check whether org.keycloak:keycloak-core is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

org.keycloak:keycloak-core

Vulnerabilities

Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination

Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity

Keycloak Denial of Service vulnerability

Keycloak Open Redirect vulnerability

Duplicate Advisory: Keycloak: Leak of configured LDAP bind credentials

keycloak-core: open redirect via "form_post.jwt" JARM response mode

Keycloak allows cross-site scripting (XSS)

Moderate severity vulnerability that affects org.keycloak:keycloak-core

Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown

Keycloak vulnerable to Plaintext Storage of User Password

Keycloak XSS via use of malicious payload as group name when creating new group from admin console

Keycloak vulnerable to Improper Certificate Validation

Duplicate Advisory: Keycloak Uses a Key Past its Expiration Date

Duplicate Advisory: Keycloak DoS via account lockout

Duplicate Advisory: Keycloak user may register themselves with same email ID of any existing user

Duplicate Advisory: Keycloak allows impersonation and lockout due to email trust not being handled correctly

Duplicate Advisory: Keycloak vulnerable to untrusted certificate validation

Duplicate Advisory: Keycloak vulnerable to Cross-Site Scripting (XSS)

Moderate severity vulnerability that affects org.keycloak:keycloak-core

Improper Restriction of Rendered UI Layers or Frames in Keycloak

Moderate severity vulnerability that affects org.keycloak:keycloak-core

Keycloak Insufficient Session Expiry

Keycloak users may be able to remove MFA from other users' devices

Keycloak discloses information without authentication

Keycloak leaks sensitive information in logged exceptions

Keycloak: Impersonation and lockout possible through incorrect handling of email trust

Keycloak Missing authentication for critical function

Keycloak Untrusted Certificate Validation vulnerability

JBoss KeyCloak Cross-site Scripting Vulnerability

Improper Input Validation in Keycloak

Keycloak Open Redirect

Keycloak has Files or Directories Accessible to External Parties

keycloak vulnerable to unauthorized login via mail server setup

keycloak-core vulnerable to timing attacks against JWS token verification

keycloak-core discloses system properties

Keycloak has lack of validation of access token on client registrations endpoint

Improper authorization in Keycloak

Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow

Cross-site Scripting in Keycloak

Temporary Directory Hijacking Vulnerability in Keycloak

keycloak Self Stored Cross-site Scripting vulnerability

Authentication Bypass in keycloak

Exposure of Sensitive Information in keycloak

Predictable password in Keycloak

XSS in Keycloak

Improper privilege management in Keycloak

Keycloak vulnerable to Server-Side Request Forgery

Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak

Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

Exposure of Sensitive Information to an Unauthorized Actor in Keycloak

Improper Verification of Cryptographic Signature in keycloak

Improper Input Validation and Cross-Site Request Forgery in Keycloak

Privilege Defined With Unsafe Actions in Keycloak

Improper Authentication in Keycloak

Moderate severity vulnerability that affects org.keycloak:keycloak-core

Keycloak vulnerable to infinite loop based Denial of Service

Improper Authentication in org.keycloak:keycloak-core

Keycloak vulnerable to uncontrolled resource consumption

Browse more Maven advisories

Start Securing