Keycloak vulnerabilities

A flaw in Keycloak's SAML broker endpoint fails to properly validate encrypted assertions when the overall SAML response is unsigned. An attacker with a valid signed assertion can inject an encrypted assertion for an arbitrary principal.

A flaw was found in Keycloak. An authorization bypass vulnerability in the Keycloak Admin API allows any authenticated user, even those without administrative privileges, to enumerate the organization memberships of other users. This information disclosure occurs if the attacker knows the victim's unique identifier (UUID) and the Organizations feature is enabled.

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication.

A flaw was found in the org.keycloak.broker.saml component. When a disabled SAML client is configured as an IdP-initiated broker landing target, it can still complete the login process and establish an SSO session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, bypassing security restrictions.

A vulnerability in Keycloak allows authentication through a disabled Identity Provider (IdP) by reusing a previously generated login request. An attacker knowing the IdP alias can bypass the administrative restriction and gain access.

A flaw was found in Keycloak's WebAuthn registration component. This vulnerability allows an attacker to bypass the configured attestation policy and register untrusted or forged authenticators via submission of an attestation object with fmt: "none", even when the realm is configured to require direct attestation. This can lead to weakened authentication integrity and unauthorized authenticator registration.

A flaw in Keycloak allows an attacker to modify the organization ID and target email in a valid invitation JWT token. Lack of cryptographic signature verification enables self-registration into an unauthorized organization.

A flaw was found in Keycloak in the jwt-authorization-grant flow where the server fails to verify if an Identity Provider (IdP) is enabled before issuing tokens. The issuer lookup mechanism retrieves the IdP configuration but does not filter for isEnabled=false. An entity possessing the signing key of a disabled IdP can still generate valid JWT assertions that Keycloak accepts, resulting in valid access tokens.

This CVE number has been rejected. After further review by the Keycloak project and Red Hat, the reported SSRF via client registration/backchannel notification URIs was determined not to constitute a security vulnerability. The reported behavior is expected administrator-controlled functionality, and Keycloak provides documented mitigations through Client Policies.

A flaw was found in Keycloak. This improper input validation vulnerability occurs because Keycloak accepts RFC-compliant matrix parameters in URL path segments, while common reverse proxy configurations may ignore or mishandle them. A remote attacker can craft requests to mask path segments, potentially bypassing proxy-level path filtering. This could expose administrative or sensitive endpoints that operators believe are not externally reachable.

A flaw was found in Keycloak. The Keycloak guides recommend not to expose the /admin path to the outside when using a proxy. The issue occurs at least via ha-proxy, as it can be tricked into using relative/non-normalized paths to access the /admin application path relative to /realms, which is expected to be exposed.

A flaw was found in Keycloak that allows an authenticated attacker to merge their account with an existing victim's account during identity provider login. The attacker can change their email address to that of the victim, triggering a verification email to the victim.

A flaw was found in Keycloak where the org.keycloak.authorization package may be vulnerable to circumventing required actions, allowing users to bypass requirements such as setting up two-factor authentication.

A flaw was found in Keycloak where JWT tokens used for authentication are cached until expiration. If a client uses JWT tokens with excessively long expiration times (e.g., 24 or 48 hours), the cache can grow indefinitely, leading to an OutOfMemoryError.

A flaw was found in the Keycloak organization feature, which allows incorrect assignment of an organization to a user if their username or email matches the organization's domain pattern. This occurs at the mapper level, leading to misrepresentation in tokens.

A flaw was found in Keycloak where when an Active Directory user resets their password, the system updates it without performing an LDAP bind to validate the new credentials. This allows users with expired or disabled AD accounts to regain access in Keycloak, bypassing AD restrictions.

A vulnerability was found in Keycloak where admin users may access sensitive server environment variables and system properties through user-configurable URLs. When configuring backchannel logout URLs or admin URLs, admins can include placeholders like ${env.VARNAME} or ${PROPNAME}, which the server replaces with actual values during URL processing.

A denial of service vulnerability was found in Keycloak that could allow an administrative user with the right to change realm settings to disrupt the service. This is done by modifying security headers and inserting newlines, causing the server to write to a terminated request, leading to failure.

A vulnerability was found in Keycloak where the environment option `KC_CACHE_EMBEDDED_MTLS_ENABLED` does not work and the JGroups replication configuration is always used in plain text, which can allow an attacker with access to adjacent networks related to JGroups to read sensitive information.

A vulnerability was found in Keycloak Server, making it vulnerable to denial of service due to improper handling of proxy headers. When configured to accept incoming proxy headers, it may accept non-IP values without validation, leading to costly DNS resolution operations that can tie up IO threads and cause DoS. The attacker must have access to a Keycloak instance configured to accept proxy headers, especially when reverse proxies do not overwrite incoming headers.

A vulnerability in Keycloak allows a user with high privileges to read sensitive information from a Vault file outside the expected context. The attacker must have prior high access to the Keycloak server, for example, to configure an LDAP provider and set up a Vault file read, which only reveals whether the file exists.

A flaw in Keycloak causes sensitive runtime values, such as passwords, to be captured during the build process and embedded as default values in bytecode, leading to unintended information disclosure. This affects direct environment variables in Keycloak 26 and indirect usage in earlier versions.

A vulnerability in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

A flaw in SAML client registration in Keycloak allows an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission.

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

A flaw in Keycloak where it does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This affects any client that utilizes a wildcard in the Valid Redirect URIs field and requires user interaction within the malicious URL.

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt", which could be used to bypass the security patch implemented to address CVE-2023-6134.

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments with millions of offline tokens (more than 500,000 users, each having at least 2 saved sessions). If an attacker creates two or more user sessions and then opens the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions, leading to excessive memory and CPU consumption which could potentially crash the entire system.