It was found that keycloak before 3.4.2 final would permit misuse of a client-side /etc/hosts entry to spoof a URL in a password reset request. An attacker could use this flaw to craft a malicious password reset request and gain a valid reset token, leading to information disclosure or further attacks.
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HKeycloak
APPKeycloak< 3.4.2
Related vulnerabilities
JBoss KeyCloak before 1.0.3.Final allows remote attackers to cause a denial of service (resource consumption) ...
It was found that the cookie used for CSRF prevention in Keycloak was not unique to each session. An attacker ...
The org.keycloak.services.resources.SocialResource.callback method in JBoss KeyCloak before 1.0.3.Final allows...
It was found that Keycloak would accept a HOST header URL in the admin console and use it to determine web res...
It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker...