Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 49
Reset filtersKeycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination
Keycloaks's One Time Passcode (OTP) is valid longer than expiration timeSeverity
Keycloak Denial of Service vulnerability
Keycloak Open Redirect vulnerability
keycloak-core: open redirect via "form_post.jwt" JARM response mode
Keycloak vulnerable to Plaintext Storage of User Password
Keycloak: Impersonation and lockout possible through incorrect handling of email trust
Keycloak Untrusted Certificate Validation vulnerability
Keycloak has lack of validation of access token on client registrations endpoint
Keycloak has Files or Directories Accessible to External Parties
Keycloak allows anyone to register new security device or key for any user by using WebAuthn password-less login flow
Stored Cross-Site Scripting (XSS) in Keycloak via groups dropdown
Keycloak vulnerable to Improper Certificate Validation
Keycloak discloses information without authentication
Keycloak vulnerable to Server-Side Request Forgery
Keycloak Insufficient Session Expiry
Keycloak leaks sensitive information in logged exceptions
Keycloak users may be able to remove MFA from other users' devices
keycloak vulnerable to unauthorized login via mail server setup
JBoss KeyCloak Cross-site Scripting Vulnerability
Keycloak Open Redirect
Improper authorization in Keycloak
Cross-site Scripting in Keycloak
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.