Most recent entries from all

Withdrawn: CLEANSTART-2026-FA60324 — It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session

Withdrawn by the publisher.

Affected: CleanStart: keycloak

Multiple security vulnerabilities affect the keycloak package. It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. See references for individual vulnerability details.

cnvd-2017-32892

EUVD-2026-172895

fkie_cve-2017-12159

It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker could use this flaw to gain access to an authenticated user session, leading to possible information disclosure or further attacks.

GHSA-7fmw-85qm-h22p — Keycloak CSRF Vulnerability

Affected: Maven: org.keycloak:keycloak-parent

gsd-2017-12159

RHSA-2017:2904 — Red Hat Security Advisory: rh-sso7-keycloak security update

jasypt: Vulnerable to timing attack against the password hash comparison keycloak: reflected XSS using HOST header keycloak: CSRF token fixation keycloak: resource privilege extension via access token in oauth libpam4j: Account check bypass