Most recent entries from all

EUVD-2026-67215

fkie_cve-2018-14655

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using 'response_mode=form_post' it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

GHSA-458h-wv48-fq75 — Keycloak vulnerable to cross-site scripting via the state parameter

Affected: Maven: org.keycloak:keycloak-parent

A flaw was found in Keycloak 3.4.3.Final, 4.0.0.Beta2, 4.3.0.Final. When using `response_mode=form_post` it is possible to inject arbitrary Javascript-Code via the 'state'-parameter in the authentication URL. This allows an XSS-Attack upon succesfully login.

gsd-2018-14655

RHSA-2018:3592 — Red Hat Security Advisory: Red Hat Single Sign-On 7.2.5 on RHEL 6 security and bug fix update

keycloak: auth permitted with expired certs in SAML client keycloak: expiration not validated in SAML broker consumer endpoint keycloak: XSS-Vulnerability with response_mode=form_post keycloak: brute force protection not working for the entire login workflow keycloak: Open Redirect in Login and Logout