Most recent entries from all

bdu:2023-08559

EUVD-2026-330503

fkie_cve-2023-6484

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

GHSA-j628-q885-8gr5 — Keycloak vulnerable to log Injection during WebAuthn authentication or registration

Affected: Maven: org.keycloak:keycloak-services

A flaw was found in keycloak 22.0.5. Errors in browser client during setup/auth with "Security Key login" (WebAuthn) are written into the form, send to Keycloak and logged without escaping allowing log injection.

Acknowledgements: Special thanks toTheresa Henze for reporting this issue and helping us improve our security.

gsd-2023-6484

RHSA-2024:0798 — Red Hat Security Advisory: Red Hat Single Sign-On 7.6.7 security update on RHEL 7

guava: insecure temporary directory creation keycloak: reflected XSS via wildcard in OIDC redirect_uri keycloak: redirect_uri validation bypass keycloak: Log Injection during WebAuthn authentication or registration keycloak: open redirect via "form_post.jwt" JARM response mode jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter() jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies santuario: Private Key disclosure in debug-log output

WID-SEC-W-2024-0406 — Keycloak und Red Hat Single Sign On: Schwachstelle ermöglicht Manipulation von Dateien

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Keycloak und Red Hat Single Sign On ausnutzen, um Dateien zu manipulieren.