Keycloak vulnerabilities

A vulnerability was found in Keycloak Server, making it vulnerable to denial of service due to improper handling of proxy headers. When configured to accept incoming proxy headers, it may accept non-IP values without validation, leading to costly DNS resolution operations that can tie up IO threads and cause DoS. The attacker must have access to a Keycloak instance configured to accept proxy headers, especially when reverse proxies do not overwrite incoming headers.

A vulnerability in Keycloak allows a user with high privileges to read sensitive information from a Vault file outside the expected context. The attacker must have prior high access to the Keycloak server, for example, to configure an LDAP provider and set up a Vault file read, which only reveals whether the file exists.

A flaw in Keycloak causes sensitive runtime values, such as passwords, to be captured during the build process and embedded as default values in bytecode, leading to unintended information disclosure. This affects direct environment variables in Keycloak 26 and indirect usage in earlier versions.

A vulnerability in the Keycloak-services package. If untrusted data is passed to the SearchQueryUtils method, it could lead to a denial of service (DoS) scenario by exhausting system resources due to a Regex complexity.

A misconfiguration flaw was found in Keycloak. This issue can allow an attacker to redirect users to an arbitrary URL if a 'Valid Redirect URI' is set to http://localhost or http://127.0.0.1, enabling sensitive information such as authorization codes to be exposed to the attacker, potentially leading to session hijacking.

A flaw in SAML client registration in Keycloak allows an administrator to register malicious JavaScript URIs as Assertion Consumer Service POST Binding URLs (ACS), posing a Cross-Site Scripting (XSS) risk. This may allow a malicious admin in one realm or a client with registration access to target users in different realms or applications, executing arbitrary JavaScript in their contexts upon form submission.

A log injection flaw was found in Keycloak. A text string may be injected through the authentication form when using the WebAuthn authentication mode. This issue may have a minor impact to the logs integrity.

A flaw in Keycloak where it does not properly validate URLs included in a redirect. An attacker could construct a malicious request to bypass validation and access other URLs and sensitive information within the domain or conduct further attacks. This affects any client that utilizes a wildcard in the Valid Redirect URIs field and requires user interaction within the malicious URL.

A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users.

A flaw was found in Keycloak. This issue may allow an attacker to steal authorization codes or tokens from clients using a wildcard in the JARM response mode "form_post.jwt", which could be used to bypass the security patch implemented to address CVE-2023-6134.

A flaw was found in Keycloak that prevents certain schemes in redirects, but permits them if a wildcard is appended to the token. This issue could allow an attacker to submit a specially crafted request leading to cross-site scripting (XSS) or further attacks. This flaw is the result of an incomplete fix for CVE-2020-10748.

An unconstrained memory consumption vulnerability was discovered in Keycloak. It can be triggered in environments with millions of offline tokens (more than 500,000 users, each having at least 2 saved sessions). If an attacker creates two or more user sessions and then opens the "consents" tab of the admin User Interface, the UI attempts to load a huge number of offline client sessions, leading to excessive memory and CPU consumption which could potentially crash the entire system.