Red Hat build of Keycloak 24 vulnerabilities

3 known vulnerabilities in Red Hat build of Keycloak 24 from Red Hat. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.7 High severity

  Red Hat Build of Keycloak: Improper Verification of Cryptographic Signature

  CVE-2024-8698Sep 19, 2024Red HatEPSS 2.03%

  A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the

• 7.1 High severity

  Red Hat Build of Keycloak: Session Fixation

  CVE-2024-7341Sep 9, 2024Red Hat

  A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks th

• 7.5 High severity

  Red Hat Build of Keycloak: Cleartext Storage of Sensitive Information

  CVE-2024-4540Jun 3, 2024Red Hat

  A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain text in the KC_RESTART cookie returned by the authorization server's HTTP response to a `request_uri` authorization req