org.keycloak:keycloak-parent (Maven)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 20.0.5 or later clears every advisory below that has a fix.

Upgrade commands

maven

<dependency><groupId>org.keycloak</groupId><artifactId>keycloak-parent</artifactId><version>20.0.5</version></dependency>

gradle

implementation("org.keycloak:keycloak-parent:20.0.5")

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-fwhw-chw4-gh37 Keycloak Server-Side Request Forgery (SSRF) vulnerability	Low	`<= 26.5.2`	No fix yet
GHSA-gv94-wp4h-vv8p Keycloak has Incorrect Behavior Order: Authorization Before Parsing and Canonicalization	Medium EPSS 0.40%	`<= 26.5.0`	No fix yet
GHSA-3p75-q5cc-qmj7 Duplicate Advisory: Keycloak Open Redirect vulnerability Withdrawn	Medium	`<= 23.0.3`	No fix yet
GHSA-9hhc-pj4w-w5rv Keycloak Cross-site Scripting on OpenID connect login service	Medium EPSS 1.19%	`< 20.0.5`	`20.0.5`
GHSA-g8q8-fggx-9r3q Keycloak vulnerable to path traversal via double URL encoding	Critical EPSS 5.95%	`< 20.0.2`	`20.0.2`
GHSA-97g8-xfvw-q4hg Keycloak vulnerable to session takeover with OIDC offline refreshtokens	Medium EPSS 0.95%	`< 20.0.2`	`20.0.2`
GHSA-w9mf-83w3-fv49 Keycloak vulnerable to Stored Cross site Scripting (XSS) when loading default roles	Medium EPSS 0.70%	`< 19.0.2`	`19.0.2`
GHSA-wf7g-7h6h-678v Keycloak SAML javascript protocol mapper: Uploading of scripts through admin console	High EPSS 1.00%	`< 19.0.2`	`19.0.2`
GHSA-xv7h-95r7-595j Incorrect implementation of lockout feature in Keycloak	High EPSS 0.80%	`< 13.0.0`	`13.0.0`
GHSA-jf86-9434-f8c2 Keycloak Authentication Error	Critical EPSS 1.05%	`>= 7.0.0, <= 7.0.1`	No fix yet
GHSA-fv4q-wm8c-wjg4 Keycloak Authentication Error	High EPSS 1.08%	`>= 7.0.0, <= 7.0.1`	No fix yet
GHSA-7fmw-85qm-h22p Keycloak CSRF Vulnerability	High EPSS 2.71%	`< 3.4.0`	`3.4.0`
GHSA-v38p-mqq3-m6v5 Keycloak Reflected XSS	Medium EPSS 1.02%	`< 3.4.0`	`3.4.0`
GHSA-458h-wv48-fq75 Keycloak vulnerable to cross-site scripting via the state parameter	Medium EPSS 1.19%	`<= 3.4.3.Final`	No fix yet
GHSA-458h-wv48-fq75 Keycloak vulnerable to cross-site scripting via the state parameter	Medium EPSS 1.19%	`>= 4.0.0.Beta1, <= 4.0.0.Beta2`	No fix yet
GHSA-458h-wv48-fq75 Keycloak vulnerable to cross-site scripting via the state parameter	Medium EPSS 1.19%		No fix yet
GHSA-qc72-gfvw-76h7 Keycloak Oauth Implementation Error	High EPSS 1.92%	`< 3.3.0.Final`	`3.3.0.Final`
GHSA-85v8-vx4w-q684 Keycloak Improper Bruteforce Detection	High EPSS 1.16%	`< 4.6.0.Final`	`4.6.0.Final`
GHSA-m98g-63qj-fp8j Reflected XSS on clients-registrations endpoint	Medium	`>= 10.0.0, < 18.0.0`	`18.0.0`
GHSA-cm29-6wx7-p874 Keycloak insufficient session expiration	High EPSS 0.30%	`< 14.0.0`	`14.0.0`
GHSA-j229-2h63-rvh9 Improper Authentication for Keycloak	High EPSS 1.00%	`< 8.0.0`	`8.0.0`
GHSA-rvfc-g8j5-9ccf Generation of Error Message Containing Sensitive Information in Keycloak	Low EPSS 0.77%	`<= 7.0.1`	No fix yet
GHSA-p225-pc2x-4jpm Incorrect Authorization in keycloak	Medium EPSS 0.69%	`< 13.0.0`	`13.0.0`
GHSA-cp67-8w3w-6h9c Path Traversal	High EPSS 1.38%	`< 12.0.0`	`12.0.0`
GHSA-72j4-94rx-cr6w Incorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak	Medium EPSS 1.64%	`< 10.0.0`	`10.0.0`
GHSA-52rg-hpwq-qp56 Allocation of Resources Without Limits or Throttling in Keycloak	High EPSS 1.95%	`< 11.0.1`	`11.0.1`
GHSA-hgpg-593r-hhvp Cross-site Scripting in Keycloak	Medium EPSS 0.93%	`< 10.0.2`	`10.0.2`
GHSA-c597-f74m-jgc2 Improper Certificate Validation and Improper Validation of Certificate with Host Mismatch in Keycloak	Medium EPSS 0.93%	`< 10.0.0`	`10.0.0`
GHSA-2mq8-99q7-55wx Code injection in keycloak	High EPSS 1.19%	`>= 9.0.0, < 12.0.3`	`12.0.3`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor