Redhat: >> Keycloak >> 3.2.1 Security Vulnerabilities
The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.
CVSS Score
6.1
EPSS Score
0.003
Published
2018-11-30
A flaw was found in JBOSS Keycloak 3.2.1.Final. The Redirect URL for both Login and Logout are not normalized in org.keycloak.protocol.oidc.utils.RedirectUtils before the redirect url is verified. This can lead to an Open Redirection attack
CVSS Score
6.1
EPSS Score
0.002
Published
2018-11-13
keycloak before version 4.0.0.final is vulnerable to a infinite loop in session replacement. A Keycloak cluster with multiple nodes could mishandle an expired session replacement and lead to an infinite loop. A malicious authenticated user could use this flaw to achieve Denial of Service on the server.
CVSS Score
4.4
EPSS Score
0.005
Published
2018-07-23
Page 6