https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:47:16 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-05657 bdu:2023-05657 https://cve.radiocsirt.org/vuln/bdu:2023-05657 https://cve.radiocsirt.org/vuln/euvd-2026-6968 EUVD-2026-6968 https://cve.radiocsirt.org/vuln/euvd-2026-6968 https://cve.radiocsirt.org/vuln/fkie_cve-2023-2585 <p>Keycloak&#39;s device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.</p> <p>Keycloak&#39;s device authorization grant does not correctly validate the device code and client ID. An attacker client could abuse the missing validation to spoof a client consent request and trick an authorization admin into granting consent to a malicious OAuth client or possible unauthorized access to an existing OAuth client.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-2585 https://cve.radiocsirt.org/vuln/ghsa-f5h4-wmp5-xhg6 <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-services, Maven: org.keycloak:keycloak-server-spi-private</p> <p>Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.</p> <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-services, Maven: org.keycloak:keycloak-server-spi-private</p> <p>Under certain pre-conditions the vulnerability allows an attacker to spoof parts of the device flow and use a device_code to retrieve an access token for other OAuth clients.</p> https://cve.radiocsirt.org/vuln/ghsa-f5h4-wmp5-xhg6 https://cve.radiocsirt.org/vuln/gsd-2023-2585 gsd-2023-2585 https://cve.radiocsirt.org/vuln/gsd-2023-2585 https://cve.radiocsirt.org/vuln/rhsa-2023:3883 <p>RHSSO: XSS due to lax URI scheme validation Undertow: Infinite loop in SslConduit during close keycloak: Untrusted Certificate Validation keycloak: oauth client impersonation keycloak: client access via device auth request spoof</p> <p>RHSSO: XSS due to lax URI scheme validation Undertow: Infinite loop in SslConduit during close keycloak: Untrusted Certificate Validation keycloak: oauth client impersonation keycloak: client access via device auth request spoof</p> https://cve.radiocsirt.org/vuln/rhsa-2023:3883 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1573 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak und Red Hat Single Sign On ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Keycloak und Red Hat Single Sign On ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1573