GitHub Advisoryadvisory · Maven

GHSA-rvjg-gxwx-j5gf OIDC Logout redirect in keycloak

LOW Published 2022-04-28 Modified 2022-04-28 Official page ↗
Aliases
CVE-2020-10734
Ecosystem
Maven
Packages
org.keycloak:keycloak-oidc-client-adapter-pom
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-601
Reviewed
2022-04-28

Affected packages

• Maven org.keycloak:keycloak-oidc-client-adapter-pom: < 18.0.0 → fixed in 18.0.0

Description

A flaw was found in keycloak. The OIDC logout endpoint does not have CSRF protection. The highest threat from this vulnerability is to system availability.

Related

Alias · CVE (1)

  • CVE-2020-10734 A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References