Database/Control plane, storage & DevOps
Keycloak: Redirect scheme filtering bypassed by appending a wildcard
CVSS 4.6CVE-2023-6134Control plane, storage & DevOpscurated
Impact
Redirect scheme filtering bypassed by appending a wildcard -> XSS and follow-on attacks
Who can reach it
Network (remote)
What to do
Control-plane: upgrade; tighten allowed redirect URIs
References
Related entries
- Keycloak: Wildcard in the JARM form_post.jwt response modeCVE-2023-6927 · KeycloakMedium
- Keycloak: SAML signature scope determined by position, not ReferenceCVE-2024-8698 · KeycloakHigh
- Keycloak: Regex complexity in SearchQueryUtilsCVE-2024-10270 · KeycloakMedium
- Keycloak: OIDC authentication flaw - attacker reusing data from a same-realm request impersonates a userCVE-2023-0264 · KeycloakMedium
- MinIO (SFTP gateway): The SFTP frontend trusts an SSH public key it should not, letting an attacker authenticate asCVE-2025-27414 · MinIO (SFTP gateway)Medium
- HashiCorp Vault: KV v2 leaks sensitive payload content into server and audit logs on malformed requestsCVE-2025-4166 · HashiCorp VaultMedium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.