maven

org.keycloak:keycloak-services

100 Total advisories

100 Vulnerabilities

0 Malware

Dependency scanning

Check whether org.keycloak:keycloak-services is in your codebase

Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.

org.keycloak:keycloak-services

Vulnerabilities

Duplicate Advisory: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Keycloak has an Out-of-bounds Read

Keycloak has Insufficient Session Expiration

Keycloak has an Authentication Bypass by Primary Weakness

Keycloak Vulnerable to Incorrect Authorization

Keycloak has privilege escalation via improper scope mapping enforcement

Keycloak Vulnerable to Improper Handling of Insufficient Permissions or Privilege

Keycloak Generates an Error Message Containing Sensitive Information

Duplicate Advisory: Keycloak has privilege escalation via improper scope mapping enforcement

Keycloak has an Improper Verification of Cryptographic Signature issue

Keycloak Vulnerable to Improper Validation of Specified Quantity in Input

Keycloak Services has Improper Validation of Consistency within Input

Keycloak Account Resources user lookup contains broken access control

Keycloak Protection API allows authenticated clients to access and modify resources owned by other Resource Servers

Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation

Keycloak: Insufficient verification proof scoping enables identity provider account linking attack and account compromise

Keycloak: Revoked Tokens Can Remain Active When Both Realm-Level and Client-Level `notBefore` Revocation Policies are Configured

Keycloak has a Forced Browsing issue

Keycloak's identity-first login flow exposes user information

Keycloak: Open redirect when using wildcard valid redirect URIs in Keycloak

Keycloak: Unauthorized account takeover via WebAuthn token replay

Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass

Keycloak: Information Disclosure via evaluate-scopes Admin API

Keycloak: Access token disclosure and implicit flow bypass via forged client data

Keycloak: Session fixation in OIDC login flow that can lead to account takeover

Keycloak: Unauthorized authentication via disabled SAML Identity Provider

Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page

Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false

Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation

Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim

Keycloak: manage-clients permission escalates to full realm admin access

Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint

Keycloak: Replay of action tokens via improper handling of single-use entries

Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw

Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants

Keycloak: Application-Level DoS via Scope Processing

Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure

Keycloak Admin REST API exposes backend schema and rules

Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions

Keycloak: Information disclosure of disabled user attributes via administrative endpoint

Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API

Keycloak does not validate and update refresh token usage atomically

Keycloak: Denial of Service due to excessive SAMLRequest decompression

Improper Authorization in Keycloak

HTML Injection in Keycloak Admin REST API

Keycloak vulnerable to privilege escalation on Token Exchange feature

Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator

Keycloak: Missing Check on Disabled Client for Docker Registry Protocol

Keycloak's missing timestamp validation allows attackers to extend SAML response validity periods

Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass

Keycloak does not invalidate sessions when "Remember Me" is disabled

Keycloak does not invalidate offline sessions when the offline_access scope is removed

Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService

Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens

Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes

Keycloak affected by improper invitation token validation

Keycloak services allows the issuance of access and refresh tokens for disabled users

Keycloak Cross-site Scripting (XSS) via assertion consumer service URL in SAML POST-binding flow

Keycloak has Vulnerable Redirect URI Validation Results in Open Redirect

org.keycloak:keycloak-services has Inefficient Regular Expression Complexity

Keycloak exposes sensitive information in Pushed Authorization Requests (PAR)

Keycloak vulnerable to user impersonation via stolen UUID code

Keycloak hostname verification

Keycloak vulnerable to impersonation via logout token exchange

Keycloak's admin API allows low privilege users to use administrative functions

Keycloak's unvalidated cross-origin messages in checkLoginIframe leads to DDoS

Keycloak Authorization Bypass vulnerability

Keycloak path traversal vulnerability in redirection validation

Keycloak vulnerable to session hijacking via re-authentication

Keycloak secondary factor bypass in step-up authentication

Keycloak vulnerable to session takeovers due to reuse of session identifiers

Keycloak vulnerable to two factor authentication bypass

Keycloak path traversal vulnerability in the redirect validation

Keycloak has session fixation in Elytron SAML adapters

Keycloak SMTP Inject Vulnerability

Duplicate Advisory: Keycloak-services SMTP Inject Vulnerability

Keycloak phishing attack via email verification step in first login flow