Red Hat Build Of Keycloak 22 vulnerabilities

10 CVEs affecting Red Hat Build Of Keycloak 22, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-0657, published 2024-11-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2024-8698, published 2024-09-19. High severity, CVSS 7.7. EPSS: 2% chance of exploitation in the next 30 days. A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for…
CVE-2023-6544, published 2024-04-25. Medium severity, CVSS 5.4. EPSS: 1.1% chance of exploitation in the next 30 days. A flaw was found in the Keycloak package. This issue occurs due to a permissive regular expression hardcoded for filtering which allows hosts to register a dynamic client. A malicious user with…
CVE-2023-6484, published 2024-04-25. Medium severity, CVSS 5.3. EPSS: 1% chance of exploitation in the next 30 days. A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs…
CVE-2023-6717, published 2024-04-25. Medium severity, CVSS 6.0. EPSS: 0.7% chance of exploitation in the next 30 days. A flaw was found in the SAML client registration in Keycloak that could allow an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a…
CVE-2024-5967, published 2024-06-18. Low severity, CVSS 2.7. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability was found in Keycloak. The LDAP testing endpoint allows changing the Connection URL independently without re-entering the currently configured LDAP bind credentials. This flaw allows…
CVE-2023-3597, published 2024-04-25. Medium severity, CVSS 5.0. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Keycloak, where it does not correctly validate its client step-up authentication in org.keycloak.authentication. This flaw allows a remote user authenticated with a password to…
CVE-2024-4540, published 2024-06-03. High severity, CVSS 7.5. EPSS: 0.6% chance of exploitation in the next 30 days. A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the…
CVE-2024-2419, published 2024-04-17. High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days. A flaw was found in Keycloak's redirect_uri validation logic. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to the theft of an access token, making…
CVE-2024-1249, published 2024-04-17. High severity, CVSS 7.4. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in Keycloak's OIDC component in the "checkLoginIframe," which allows unvalidated cross-origin messages. This flaw allows attackers to coordinate and send millions of requests in…
CVE-2023-0657, published 2024-11-17. Low severity, CVSS 3.4. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in Keycloak. This issue occurs due to improperly enforcing token types when validating signatures locally. This could allow an authenticated attacker to exchange a logout token for…