org.keycloak:keycloak-services

vulnerable: 26.3.0 ... 26.4.7 (14 versions)

A flaw was found in Keycloak. An attacker can exploit this vulnerability by modifying the organization ID and target email within a legitimate invitation token's JSON Web Token (JWT) payload. This lack of cryptographic signature verificati…

vulnerable: 1.0-alpha-1 ... 9.0.3 (220 versions)

A flaw was identified in the Docker v2 authentication endpoint of Keycloak, where tokens continue to be issued even after a Docker registry client has been administratively disabled. This means that turning the client “Enabled” setting…

vulnerable: 1.0-alpha-1 ... 9.0.3 (222 versions)

A flaw was found in Keycloak. An administrator with `manage-clients` permission can exploit a misconfiguration where this permission is equivalent to `manage-permissions`. This allows the administrator to escalate privileges and gain contr…

vulnerable: 1.0-alpha-1 ... 9.0.3 (222 versions)

A flaw was found in Keycloak. The User-Managed Access (UMA) 2.0 Protection API endpoint for permission tickets fails to enforce the `uma_protection` role check. This allows any authenticated user with a token issued for a resource server c…

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtain…

vulnerable: 1.0-alpha-1 ... 9.0.3 (224 versions)

A flaw was found in Keycloak. A remote attacker can exploit a Cross-Origin Resource Sharing (CORS) header injection vulnerability in Keycloak's User-Managed Access (UMA) token endpoint. This flaw occurs because the `azp` claim from a clien…

vulnerable: 1.0-alpha-1 ... 9.0.3 (222 versions)

A flaw was found in Keycloak, specifically in the organization selection login page. A remote attacker with `manage-realm` or `manage-organizations` administrative privileges can exploit a Stored Cross-Site Scripting (XSS) vulnerability. T…

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was found in Keycloak. This issue allows an attacker, who controls another path on the same web server, to bypass the allowed path in redirect Uniform Resource Identifiers (URIs) that use a wildcard. A successful attack may lead to …

vulnerable: 1.0-alpha-1 ... 9.0.3 (222 versions)

A flaw was found in Keycloak. An authenticated user with the view-users role could exploit a vulnerability in the UserResource component. By accessing a specific administrative endpoint, this user could improperly retrieve user attributes …

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an unauthenticated attacker to forge authorization codes. Successful exploitation can…

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was found in Keycloak. The SingleUseObjectProvider, a global key-value store, lacks proper type and namespace isolation. This vulnerability allows an attacker to delete arbitrary single-use entries, which can enable the replay of co…

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was found in Keycloak. An unauthenticated attacker can exploit this vulnerability by sending a specially crafted POST request with an excessively long scope parameter to the OpenID Connect (OIDC) token endpoint. This leads to high r…

vulnerable: 1.0-alpha-1 ... 9.0.3 (223 versions)

A flaw was found in Keycloak. An authenticated user with the uma_protection role can bypass User-Managed Access (UMA) policy validation. This allows the attacker to include resource identifiers owned by other users in a policy creation req…

vulnerable: 1.0-alpha-1 ... 9.0.3 (226 versions)

When Keycloak is started with `--features-disabled=account,account-api`, the Account REST API is only partially disabled. Five endpoints under the versioned path `/account/v1alpha1` remain fully functional — including both read and write…