Keycloak

keycloak

Vendor: Keycloak • 5 CVEs

CVEs (5)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2017-12161 1Keycloak 1Keycloak Nov 21, 2024 Feb 21, 2018 N/A· v4 8.8 HIGH· v3 4.3 MEDIUM· v2 It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request...Show more It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks.Show less
CVE-2014-3651 1Keycloak 1Keycloak May 13, 2026 Dec 29, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the size parameter to auth/qrcode, related to QR code generation.
CVE-2017-12159 2Keycloak Redhat 2Keycloak Single Sign On May 13, 2026 Oct 26, 2017 N/A· v4 7.5 HIGH· v3 5.0 MEDIUM· v2 It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosur...Show more It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.Show less
CVE-2017-12158 2Keycloak Redhat 2Keycloak Single Sign On May 13, 2026 Oct 26, 2017 N/A· v4 5.4 MEDIUM· v3 3.5 LOW· v2 It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a m...Show more It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.Show less
CVE-2014-3709 1Keycloak 1Keycloak May 13, 2026 Oct 18, 2017 N/A· v4 8.8 HIGH· v3 6.8 MEDIUM· v2 The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows remote attackers to conduct cross-site request forgery (CSRF) attacks by leveraging lack of CSRF protection.