Most recent entries from all

EUVD-2026-227918

fkie_cve-2022-3782

keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.

GHSA-g8q8-fggx-9r3q — Keycloak vulnerable to path traversal via double URL encoding

Affected: Maven: org.keycloak:keycloak-parent

Keycloak does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain, or possibly conduct further attacks.

gsd-2022-3782

RHSA-2022:8961 — Red Hat Security Advisory: Red Hat Single Sign-On 7.6.1 security update on RHEL 7

keycloak: path traversal via double URL encoding keycloak: Session takeover with OIDC offline refreshtokens

WID-SEC-W-2023-0200 — Keycloak: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Keycloak ausnutzen, um Sicherheitsvorkehrungen zu umgehen.