Most recent entries from all

Withdrawn: CLEANSTART-2026-FA60324 — It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session

Withdrawn by the publisher.

Affected: CleanStart: keycloak

Multiple security vulnerabilities affect the keycloak package. It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. See references for individual vulnerability details.

cnvd-2017-32893

EUVD-2026-176414

fkie_cve-2017-12158

It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web resource locations. An attacker could use this flaw against an authenticated user to attain reflected XSS via a malicious server.

GHSA-v38p-mqq3-m6v5 — Keycloak Reflected XSS

Affected: Maven: org.keycloak:keycloak-parent

gsd-2017-12158

RHSA-2017:2904 — Red Hat Security Advisory: rh-sso7-keycloak security update

jasypt: Vulnerable to timing attack against the password hash comparison keycloak: reflected XSS using HOST header keycloak: CSRF token fixation keycloak: resource privilege extension via access token in oauth libpam4j: Account check bypass