# org.keycloak:keycloak-core (Maven) vulnerabilities 48 known vulnerabilities (2 critical, 5 high, 20 medium, 4 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Dependents: 109 - Registry: https://central.sonatype.com/artifact/org.keycloak/keycloak-core ## Advisories (48) ### [CVE-2024-4028](https://cve.now/CVE-2024-4028): Keycloak-core: stored xss in keycloak when creating a items in admin console - Severity: Low 3.8 - Published: Feb 18, 2025 - Affected: through 26.1.2. ### [CVE-2023-6841](https://cve.now/CVE-2023-6841): Keycloak: amount of attributes per object is not limited and it may lead to dos - Severity: High 7.5 - Published: Sep 10, 2024 - Affected: fixed in 24.0.0. ### [CVE-2024-7318](https://cve.now/CVE-2024-7318): Keycloak-core: one time passcode (otp) is valid longer than expiration timeseverity - Severity: Medium 4.8 - Published: Sep 9, 2024 - Affected: fixed in 24.0.7; from 25.0.0, fixed in 25.0.4. ### [CVE-2024-7260](https://cve.now/CVE-2024-7260): Keycloak-core: open redirect on account page - Severity: Medium 6.1 - Published: Sep 9, 2024 - Affected: fixed in 24.0.7. ### [CVE-2023-6927](https://cve.now/CVE-2023-6927): Keycloak: open redirect via "form\_post.jwt" jarm response mode - Severity: Medium 4.6 - Published: Dec 18, 2023 - Affected: fixed in 23.0.4. ### [CVE-2023-4918](https://cve.now/CVE-2023-4918): Plaintext storage of user password - Severity: High 8.8 - Published: Sep 12, 2023 - Affected: from 22.0.2, fixed in 22.0.3. ### [CVE-2023-1664](https://cve.now/CVE-2023-1664): A flaw was found in Keycloak. - Severity: Medium 6.5 - Published: May 26, 2023 - Affected: fixed in 21.1.2. ### [CVE-2023-0105](https://cve.now/CVE-2023-0105): A flaw was found in Keycloak. - Severity: Medium 6.5 - Published: Jan 11, 2023 - Affected: fixed in 22.0.1. ### [CVE-2023-0091](https://cve.now/CVE-2023-0091): A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. - Severity: Low 3.8 - Published: Jan 11, 2023 - Affected: fixed in 20.0.3. ### [CVE-2022-0225](https://cve.now/CVE-2022-0225): A flaw was found in Keycloak. - Severity: Unrated - Published: Aug 26, 2022 - Affected: fixed in 20.0.0; through 16.1.0. ### [CVE-2021-3632](https://cve.now/CVE-2021-3632): A flaw was found in Keycloak. - Severity: Unrated - Published: Aug 26, 2022 - Affected: fixed in 15.1.0. ### [CVE-2021-3856](https://cve.now/CVE-2021-3856): ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. - Severity: Unrated - Published: Aug 26, 2022 - Affected: fixed in 15.1.0. ### [CVE-2020-35509](https://cve.now/CVE-2020-35509): A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. - Severity: Medium 5.4 - Published: Aug 23, 2022 - Affected: fixed in 14.0.0. ### [CVE-2022-1466](https://cve.now/CVE-2022-1466): Due to improper authorization, Red Hat Single Sign-On is vulnerable to users performing actions that they should not be allowed to perform. - Severity: Unrated - Published: Apr 26, 2022 - Affected: fixed in 17.0.1. ### [CVE-2021-20323](https://cve.now/CVE-2021-20323): A POST based reflected Cross Site Scripting vulnerability on has been identified in Keycloak. - Severity: Unrated - Published: Mar 25, 2022 - Affected: from 15.0.0, fixed in 17.0.0. ### [CVE-2021-20195](https://cve.now/CVE-2021-20195): A flaw was found in keycloak in versions before 13.0.0. - Severity: Unrated - Published: May 28, 2021 - Affected: fixed in 13.0.0. ### [CVE-2020-27826](https://cve.now/CVE-2020-27826): A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. - Severity: Unrated - Published: May 28, 2021 - Affected: fixed in 12.0.0. ### [CVE-2021-20202](https://cve.now/CVE-2021-20202): A flaw was found in keycloak. - Severity: Unrated - Published: May 12, 2021 - Affected: fixed in 13.0.0. ### [CVE-2021-20262](https://cve.now/CVE-2021-20262): A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. - Severity: Unrated - Published: Mar 9, 2021 - Affected: through 12.0.4. ### [CVE-2020-27838](https://cve.now/CVE-2020-27838): A flaw was found in keycloak in versions prior to 13.0.0. - Severity: Unrated - Published: Mar 8, 2021 - Affected: fixed in 13.0.0. ### [CVE-2020-10770](https://cve.now/CVE-2020-10770): A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC… - Severity: Unrated - Published: Dec 15, 2020 - Affected: fixed in 13.0.0. ### [CVE-2020-14389](https://cve.now/CVE-2020-14389): It was found that Keycloak before version 12.0.0 would permit a user with only view-profile role to manage the resources in the new… - Severity: Unrated - Published: Nov 17, 2020 - Affected: fixed in 12.0.0. ### [CVE-2020-1714](https://cve.now/CVE-2020-1714): A flaw was found in Keycloak before version 11.0.0, where the code base contains usages of ObjectInputStream without type checks. - Severity: High 7.5 - Published: May 13, 2020 - Affected: fixed in 11.0.0. ### [CVE-2020-1724](https://cve.now/CVE-2020-1724): A flaw was found in Keycloak in versions before 9.0.2. - Severity: Medium 4.3 - Published: May 11, 2020 - Affected: fixed in 9.0.2. ### [CVE-2020-1698](https://cve.now/CVE-2020-1698): A flaw was found in keycloak in versions before 9.0.0. - Severity: Medium 5.0 - Published: May 11, 2020 - Affected: fixed in 9.0.0. ### [CVE-2019-10170](https://cve.now/CVE-2019-10170): A flaw was found in the Keycloak admin console, where the realm management interface permits a script to be set via the policy. - Severity: Medium 6.6 - Published: May 8, 2020 - Affected: fixed in 8.0.0. ### [CVE-2020-10686](https://cve.now/CVE-2020-10686): A flaw was found in Keycloak version 8.0.2 and 9.0.0, and was fixed in Keycloak version 9.0.1, where a malicious user registers as oneself. - Severity: Medium 4.1 - Published: May 4, 2020 - Affected: fixed in 9.0.2. ### [CVE-2020-1728](https://cve.now/CVE-2020-1728): A vulnerability was found in all versions of Keycloak where, the pages on the Admin Console area of the application are completely missing… - Severity: Medium 4.8 - Published: Apr 6, 2020 - Affected: through 9.0.3. ### [CVE-2020-1744](https://cve.now/CVE-2020-1744): A flaw was found in keycloak before version 9.0.1. - Severity: Medium 5.6 - Published: Mar 24, 2020 - Affected: fixed in 9.0.1. ### [CVE-2020-1731](https://cve.now/CVE-2020-1731): A flaw was found in all versions of the Keycloak operator, before version 8.0.2,(community only) where the operator generates a random… - Severity: Critical 9.1 - Published: Mar 2, 2020 - Affected: fixed in 8.0.2. ### [CVE-2020-1697](https://cve.now/CVE-2020-1697): It was found in all keycloak versions before 9.0.0 that links to external applications (Application Links) in the admin console are not… - Severity: Medium 6.1 - Published: Feb 10, 2020 - Affected: fixed in 9.0.0. ### [CVE-2019-14820](https://cve.now/CVE-2019-14820): It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can… - Severity: Medium 4.3 - Published: Jan 8, 2020 - Affected: fixed in 8.0.0. ### [CVE-2019-14837](https://cve.now/CVE-2019-14837): A flaw was found in keycloack before version 8.0.0. - Severity: Critical 9.1 - Published: Jan 7, 2020 - Affected: fixed in 8.0.0. ### [CVE-2014-3656](https://cve.now/CVE-2014-3656): JBoss KeyCloak: XSS in login-status-iframe.html - Severity: Unrated - Published: Dec 10, 2019 - Affected: fixed in 1.1.0.Beta1. ### [CVE-2019-10201](https://cve.now/CVE-2019-10201): It was found that Keycloak's SAML broker, versions up to 6.0.1, did not verify missing message signatures. - Severity: High 8.1 - Published: Aug 14, 2019 - Affected: fixed in 7.0.0. ### [CVE-2019-10199](https://cve.now/CVE-2019-10199): It was found that Keycloak's account console, up to 6.0.1, did not perform adequate header checks in some requests. - Severity: Medium 4.6 - Published: Aug 14, 2019 - Affected: fixed in 7.0.0. ### [CVE-2019-3875](https://cve.now/CVE-2019-3875): A vulnerability was found in keycloak before 6.0.2. - Severity: Medium 6.5 - Published: Jun 12, 2019 - Affected: through 6.0.1. ### [CVE-2019-3868](https://cve.now/CVE-2019-3868): Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for… - Severity: Low 3.8 - Published: Apr 24, 2019 - Affected: fixed in 6.0.0. ### [CVE-2018-14637](https://cve.now/CVE-2018-14637): The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. - Severity: Medium 6.1 - Published: Nov 30, 2018 - Affected: fixed in 4.6.0. ### [CVE-2018-14658](https://cve.now/CVE-2018-14658): A flaw was found in JBOSS Keycloak 3.2.1.Final. - Severity: Medium 6.1 - Published: Nov 13, 2018 - Affected: through 3.2.1.Final. ### [CVE-2016-8609](https://cve.now/CVE-2016-8609): It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. - Severity: Low 3.7 - Published: Aug 1, 2018 - Affected: fixed in 2.3.0. ### [CVE-2017-2646](https://cve.now/CVE-2017-2646): It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the… - Severity: High 7.5 - Published: Jul 27, 2018 - Affected: fixed in 2.5.5. ### [CVE-2017-2582](https://cve.now/CVE-2017-2582): It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining… - Severity: Medium 6.5 - Published: Jul 26, 2018 - Affected: fixed in 2.5.1. ### [CVE-2018-10912](https://cve.now/CVE-2018-10912): keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. - Severity: Medium 4.4 - Published: Jul 23, 2018 - Affected: fixed in 4.0.0. ### [CVE-2017-2585](https://cve.now/CVE-2017-2585): Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in… - Severity: Unrated - Published: Mar 12, 2018 - Affected: fixed in 2.5.1. ### [CVE-2016-8629](https://cve.now/CVE-2016-8629): Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the… - Severity: Unrated - Published: Mar 12, 2018 - Affected: fixed in 2.4.0. ### [CVE-2017-12161](https://cve.now/CVE-2017-12161): It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset… - Severity: Unrated - Published: Feb 21, 2018 - Affected: fixed in 3.4.2. ### [CVE-2014-3651](https://cve.now/CVE-2014-3651): JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) via a large value in the… - Severity: Unrated - Published: Dec 29, 2017 - Affected: fixed in 1.0.3. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.keycloak:keycloak-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.