Red Hat Single Sign-On 7 vulnerabilities
139 known vulnerabilities in Red Hat Single Sign-On 7 from Red Hat. 139 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.8 High severity
Red Hat JBoss Enterprise Application Platform…: Privilege Defined With Unsafe Actions
A flaw was found in the deployment-operation family of WildFly Core. Certain handlers, such as upload-deployment-url, lack proper sensitivity classification, allowing an administrator with the restricted "Maintainer" role to read sensitive configuration files.
- 9.1 Critical severity
Red Hat Build of Keycloak: Improper Control of Generation of Code
A flaw was found in the Keycloak server's client management component. When a client is created or imported with authorization services enabled, the system fails to properly clear an internal session attribute used during the setup process. This allows an auth
- 7.1 High severity
Red Hat build of Keycloak 26.4: Improper Authentication
A flaw was found in the protocol mapper and identity resolution components of Keycloak. The issue occurs when a client manager uses hardcoded-claim mappers to override identity claims in sessionless service-account tokens. Because these tokens lack a session I
- 8.8 High severity
Red Hat build of Keycloak 26.4.17: Improper Authentication
A flaw was found in the idp-auto-link authenticator of the keycloak-services component, which handles user identity federation. The issue occurs when Keycloak automatically links an incoming identity from an external provider to an existing local account based
- 8.0 High severity
Red Hat build of Keycloak 26.4: Improper Certificate Validation
A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from the command line. When a custom truststore is provided to verify the server identity, the tool incorrectly accepts any self-signed certificat
- 7.4 High severity
Red Hat build of Keycloak 26.4: Improper Verification of Cryptographic Signature
A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based authentication. The adapter fails to verify that the issuer of a signed SAML assertion matches the expected identity provider configured for the ap
- 8.1 High severity
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens…
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges ide
- 7.4 High severity
Red Hat build of Keycloak 26.4: Improper Authentication
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a ho
- 7.5 High severity
Red Hat build of Keycloak 26.4: Uncontrolled Resource Consumption
A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remot
- 8.1 High severity
Red Hat build of Keycloak 26.4: Missing Authorization
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a po
- 8.1 High severity
Red Hat build of Keycloak 26.6: Authentication Bypass by Primary Weakness
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belo
- 7.5 High severity
Red Hat build of Keycloak 26.6: Uncontrolled Resource Consumption
A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attac
- 7.5 High severity
Red Hat build of Keycloak 26.4: Loop with Unreachable Exit Condition
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for
- 7.5 High severity
Red Hat build of Keycloak 26.4: Loop with Unreachable Exit Condition
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing th
- 7.5 High severity
Red Hat build of Keycloak 26.6: Uncontrolled Resource Consumption
A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are
- 7.5 High severity
Red Hat build of Keycloak 26.4: Concurrent Execution using Shared Resource with Improper Synchronization
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard aut
- 9.1 Critical severity
Red Hat build of Keycloak 26.6: Improper Verification of Cryptographic Signature
A flaw was found in the SAML HTTP-Redirect binding implementation of Keycloak. The issue occurs because the server processes percent-encoded parameter names (like %53AMLResponse) while the signature verification logic only checks literal parameter names. An at
- 7.4 High severity
Red Hat JBoss Enterprise Application Platform…: Inclusion of Functionality from Untrusted Control Sphere
A flaw was found in Wildfly. A remote attacker can bypass authentication on IIOP EJB invocations as the CSIv2 security interceptor accepts ITTPrincipalName identity assertions in the service context without verifying transport-level authentication, allowing a
- 7.1 High severity
Red Hat Enterprise Linux 8: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can wr
- 8.8 High severity
Red Hat JBoss Enterprise Application Platform…: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a mi
- 7.5 High severity
Red Hat build of Apache Camel for Spring Boot 4: Improper Neutralization of CRLF Sequences
A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF
- 8.2 High severity
Red Hat Build of Apache Camel 3.33.3.SP2: Inconsistent Interpretation of HTTP Requests
A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prior
- 7.5 High severity
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending…
A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests
- 7.5 High severity
A flaw was found in Netty's HTTP/2 codec.
A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by sup
- 7.5 High severity
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips…
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP req
- 7.5 High severity
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder…
A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS)
- 7.5 High severity
A flaw was found in Netty's WebSocketServerExtensionHandler.
A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-con
- 7.5 High severity
A flaw was found in the Netty STOMP codec.
A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Den
- 7.5 High severity
Red Hat Build of Apache Camel 3.33.3.SP2: Allocation of Resources Without Limits or Throttling
A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leadi
- 7.5 High severity
Red Hat Build of Apache Camel 3.33.3.SP2: Allocation of Resources Without Limits or Throttling
A flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection
- 7.5 High severity
A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this…
A flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowi
- 7.5 High severity
Red Hat build of Apache Camel for Spring Boot 4: Allocation of Resources Without Limits or Throttling
A flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of he
- 7.5 High severity
A flaw was found in Netty's `SmtpResponseDecoder` component.
A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vuln
- 7.5 High severity
A flaw was found in Netty's StompSubframeDecoder component.
A flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) t
- 7.5 High severity
Red Hat Build of Apache Camel 3.33.4.redhat: Improper Handling of Highly Compressed Data (Data Amplification)
A flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enorm
- 7.4 High severity
Red Hat Build of Apache Camel 3.33.4.redhat: Origin Validation Error
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-orig
- 7.2 High severity
Red Hat build of Keycloak 26.4: Missing Authorization
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, incl
- 7.5 High severity
Red Hat build of Keycloak 26.4: Uncontrolled Resource Consumption
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from una
- 8.1 High severity
Red Hat build of Keycloak 26.4: Missing Authorization
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as tho
- 7.5 High severity
Red Hat build of Keycloak 26.4: Missing Release of Memory after Effective Lifetime
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An