Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 98
Reset filtersKeycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page
Keycloak vulnerable to information disclosure via CORS header injection due to unvalidated JWT azp claim
Keycloak: Replay of action tokens via improper handling of single-use entries
Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw
Keycloak: Application-Level DoS via Scope Processing
Keycloak: UMA Policy Resource Injection Allows Unauthorized Cross-User Permission Grants
Keycloak: Redirect URI validation bypass via ..;/ path traversal in OIDC auth endpoint
Keycloak: manage-clients permission escalates to full realm admin access
Keycloak: Missing Role Enforcement on UMA 2.0 Permission Ticket Endpoint Leads to Information Disclosure
Keycloak Server-Side Request Forgery via OIDC token endpoint manipulation
Keycloak's identity-first login flow exposes user information
Keycloak has Improper Access Control that allows attackers with valid credentials to bypass the allowRemoteResourceManagement=false
Keycloak: Denial of Service due to excessive SAMLRequest decompression
Keycloak: Unauthorized authentication via disabled SAML Identity Provider
Keycloak: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API
Keycloak: Information disclosure of disabled user attributes via administrative endpoint
Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator
Keycloak REST Services has a WebAuthn Attestation Statement Verification Bypass
Keycloak: Missing Check on Disabled Client for Docker Registry Protocol
Keycloak Affected by Broken Access Control Vulnerability in the UserManagedPermissionService
Keycloak fails to verify if an Identity Provider (IdP) is enabled before issuing tokens
Keycloak affected by improper invitation token validation
Keycloak Admin API allows an administrator with limited privileges to retrieve sensitive custom attributes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.