org.keycloak:keycloak-server-spi-private@24.0.1 vulnerabilities
-
latest version
26.0.5
-
latest non vulnerable version
-
first published
8 years ago
-
latest version published
19 days ago
-
licenses detected
- [2.4.0.CR1,)
-
package manager
Direct Vulnerabilities
Known vulnerabilities in the org.keycloak:keycloak-server-spi-private package. This does not include vulnerabilities belonging to this package’s dependencies.
Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.| Vulnerability | Vulnerable Version |
|---|---|
org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to URL Redirection to Untrusted Site ('Open Redirect') due to a misconfiguration flaw in the validation of redirect URIs. An attacker can redirect users to an arbitrary URL and potentially expose sensitive information such as authorization codes, leading to session hijacking. Note:
This is only exploitable if a 'Valid Redirect URI' is set to How to fix URL Redirection to Untrusted Site ('Open Redirect')? Upgrade |
[,22.0.13)
[23.0.0,24.0.8)
[25.0.0,25.0.6)
|
org.keycloak:keycloak-server-spi-private is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Missing Critical Step in Authentication in the form of not sufficiently enforcing the second factor in multifactor authentication. A user can register a second factor for a known account, allowing step-up authentication. How to fix Missing Critical Step in Authentication? Upgrade |
[,22.0.10)
[23.0.0,24.0.3)
|