Vulnerabilities > Redhat > Keycloak
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2018-08-01 | CVE-2018-10894 | Improper Certificate Validation vulnerability in Redhat Keycloak and Single Sign-On It was found that SAML authentication in Keycloak 3.4.3.Final incorrectly authenticated expired certificates. | 5.4 |
| 2018-08-01 | CVE-2016-8609 | Improper Authentication vulnerability in Redhat Keycloak It was found that the keycloak before 2.3.0 did not implement authentication flow correctly. | 8.1 |
| 2018-07-27 | CVE-2017-2646 | Infinite Loop vulnerability in Redhat Keycloak It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParser.parse() method ends in a infinite loop. | 7.5 |
| 2018-07-26 | CVE-2017-2582 | Information Exposure vulnerability in Redhat Keycloak It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. | 6.5 |
| 2018-07-23 | CVE-2018-10912 | Infinite Loop vulnerability in Redhat Keycloak keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. | 4.9 |
| 2018-05-11 | CVE-2016-8627 | Resource Exhaustion vulnerability in Redhat Jboss Enterprise Application Platform and Keycloak admin-cli before versions 3.0.0.alpha25, 2.2.1.cr2 is vulnerable to an EAP feature to download server log files that allows logs to be available via GET requests making them vulnerable to cross-origin attacks. | 6.5 |
| 2018-03-12 | CVE-2017-2585 | Information Exposure vulnerability in Redhat Keycloak Red Hat Keycloak before version 2.5.1 has an implementation of HMAC verification for JWS tokens that uses a method that runs in non-constant time, potentially leaving the application vulnerable to timing attacks. | 5.9 |
| 2018-03-12 | CVE-2016-8629 | Permissions, Privileges, and Access Controls vulnerability in Redhat Keycloak Red Hat Keycloak before version 2.4.0 did not correctly check permissions when handling service account user deletion requests sent to the rest server. | 6.5 |
| 2017-10-26 | CVE-2017-12160 | Improper Authentication vulnerability in Redhat Keycloak It was found that Keycloak oauth would permit an authenticated resource to obtain an access/refresh token pair from the authentication server, permitting indefinite usage in the case of permission revocation. | 7.2 |