What’s Vulnerable › Products

Red Hat build of Keycloak 22 vulnerabilities

10 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your Red Hat build of Keycloak 22 version is affected

Latest Red Hat build of Keycloak 22 vulnerabilities

• CVE-2023-0657 — Keycloak: impersonation via logout token exchange (CVSS 3.4)
• CVE-2024-8698 — Keycloak-saml-core: improper verification of saml responses leading to privilege escalation in keycloak (CVSS 7.7)
• CVE-2024-5967 — Keycloak: leak of configured ldap bind credentials through the keycloak admin console (CVSS 2.7)
• CVE-2024-4540 — Keycloak: exposure of sensitive information in pushed authorization requests (par) kc_restart cookie (CVSS 7.5)
• CVE-2023-6717 — Keycloak: xss via assertion consumer service url in saml post-binding flow (CVSS 6.0)
• CVE-2023-6544 — Keycloak: authorization bypass (CVSS 5.4)
• CVE-2023-6484 — Keycloak: log injection during webauthn authentication or registration (CVSS 5.3)
• CVE-2023-3597 — Keycloak: secondary factor bypass in step-up authentication (CVSS 5.0)
• CVE-2024-2419 — Keycloak: path traversal in the redirect validation (CVSS 7.1)
• CVE-2024-1249 — Keycloak: org.keycloak.protocol.oidc: unvalidated cross-origin messages in checkloginiframe leads to ddos (CVSS 7.4)