Most recent entries from all

Withdrawn: CLEANSTART-2026-FA60324 — It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session

2026-10-02T20:05:27.325129+00:00

Withdrawn by the publisher.

Affected: CleanStart: keycloak

Multiple security vulnerabilities affect the keycloak package. It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. See references for individual vulnerability details.

cnvd-2017-32892

2026-10-02T20:05:27.325192+00:00

cnvd-2017-32892

EUVD-2026-172895

2026-10-02T20:05:27.325211+00:00

EUVD-2026-172895

fkie_cve-2017-12159

2026-10-02T20:05:27.325223+00:00

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

GHSA-7fmw-85qm-h22p — Keycloak CSRF Vulnerability

2026-10-02T20:05:27.325246+00:00

Affected: Maven: org.keycloak:keycloak-parent

gsd-2017-12159

2026-10-02T20:05:27.325265+00:00

gsd-2017-12159

RHSA-2017:2904 — Red Hat Security Advisory: rh-sso7-keycloak security update

2026-10-02T20:05:27.325277+00:00

jasypt: Vulnerable to timing attack against the password hash comparison keycloak: reflected XSS using HOST header keycloak: CSRF token fixation keycloak: resource privilege extension via access token in oauth libpam4j: Account check bypass