Homepage
About Snyk

org.keycloak:keycloak-common@4.8.0.Final vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.keycloak:keycloak-common package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Open Redirect

org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services.

Affected versions of this package are vulnerable to Open Redirect due to improper validation of redirect URIs using the form_post.jwt response mode. An attacker can redirect a user to a malicious site and potentially steal authorization codes or tokens by exploiting the use of a wildcard in the JARM response.

How to fix Open Redirect?

Upgrade org.keycloak:keycloak-common to version 23.0.4 or higher.

[,23.0.4)
  • H
Remote Code Execution (RCE)

org.keycloak:keycloak-common is an Open Source Identity and Access Management For Modern Applications and Services.

Affected versions of this package are vulnerable to Remote Code Execution (RCE). It contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects.

How to fix Remote Code Execution (RCE)?

Upgrade org.keycloak:keycloak-common to version 11.0.0 or higher.

[0,11.0.0)
Go back to all versions of this package