https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 08:36:07 +0000 https://cve.radiocsirt.org/vuln/bit-keycloak-2024-7260 <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks. Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.</p> <p><strong>Affected:</strong> Bitnami: keycloak</p> <p>An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks. Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.</p> https://cve.radiocsirt.org/vuln/bit-keycloak-2024-7260 https://cve.radiocsirt.org/vuln/euvd-2026-266436 EUVD-2026-266436 https://cve.radiocsirt.org/vuln/euvd-2026-266436 https://cve.radiocsirt.org/vuln/fkie_cve-2024-7260 <p>An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks. Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.</p> <p>An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the referrer and referrer_uri parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks. Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the redirect_uri using URL encoding, to hide the text of the actual malicious website domain.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-7260 https://cve.radiocsirt.org/vuln/ghsa-g4gc-rh26-m3p5 <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-core</p> <p>An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the `referrer` and `referrer_uri` parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks.</p> <p>Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the `redirect_uri` using URL encoding, to hide the text of the actual malicious website domain.</p> <p><strong>Affected:</strong> Maven: org.keycloak:keycloak-core</p> <p>An open redirect vulnerability was found in Keycloak. A specially crafted URL can be constructed where the `referrer` and `referrer_uri` parameters are made to trick a user to visit a malicious webpage. A trusted URL can trick users and automation into believing that the URL is safe, when, in fact, it redirects to a malicious server. This issue can result in a victim inadvertently trusting the destination of the redirect, potentially leading to a successful phishing attack or other types of attacks.</p> <p>Once a crafted URL is made, it can be sent to a Keycloak admin via email for example. This will trigger this vulnerability when the user visits the page and clicks the link. A malicious actor can use this to target users they know are Keycloak admins for further attacks. It may also be possible to bypass other domain-related security checks, such as supplying this as a OAuth redirect uri. The malicious actor can further obfuscate the `redirect_uri` using URL encoding, to hide the text of the actual malicious website domain.</p> https://cve.radiocsirt.org/vuln/ghsa-g4gc-rh26-m3p5 https://cve.radiocsirt.org/vuln/rhsa-2024:6502 <p>keycloak-core: Open Redirect on Account page keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters</p> <p>keycloak-core: Open Redirect on Account page keycloak-core: One Time Passcode (OTP) is valid longer than expiration timeSeverity wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters</p> https://cve.radiocsirt.org/vuln/rhsa-2024:6502 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2083 <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um falsche Informationen darzustellen um die Authentifizierung zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um falsche Informationen darzustellen um die Authentifizierung zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-2083