| CVE-2020-35509 |
AVG-1332 |
Medium |
Yes |
Certificate verification bypass |
Depending on the webserver configuration, a malicious user can supply an expired certificate and it would be accepted by Keycloak direct- grant... |
| CVE-2020-27838 |
AVG-1332 |
Medium |
Yes |
Information disclosure |
Client registration endpoints should not allow fetching information about public clients without authentication. |
| CVE-2020-14359 |
AVG-1332 |
Medium |
Yes |
Insufficient validation |
A vulnerability was found in keycloak, where on using lower case HTTP headers (via cURL) a Gatekeeper can be bypassed. Lower case headers are also accepted... |
| CVE-2020-14302 |
AVG-1332 |
Medium |
Yes |
Insufficient validation |
A flaw was found in Keycloak before 13.0.0 where an external identity provider, after successful authentication, redirects to a Keycloak endpoint that... |
| CVE-2020-10770 |
AVG-1332 |
Medium |
Yes |
Cross-site request forgery |
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri.... |
| CVE-2020-1725 |
AVG-1332 |
Medium |
Yes |
Authentication bypass |
A security issue was found in keycloak. In some scenarios a user still has access to a resource after changing the role mappings in Keycloak and after... |
| CVE-2020-1723 |
AVG-1332 |
Low |
Yes |
Open redirect |
A security issue was found in keycloak. The logout endpoint /oauth/logout?redirect=url can be abused to redirect logged in users to arbitrary web pages.... |