Skip to content
OpenAdvisories

Vendor

redhat.com

6 known vulnerabilities.

redhat.com at a glance

Last 12 months
0
Critical · all time
1
Exploited · all time
0
Public exploit · all time
2
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Keycloak 4 Wildfly-elytron 1 RHACM 1
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 8.7
    CVE-2023-0264 Public exploit

    Keycloak vulnerable to user impersonation via stolen UUID code

    A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and g…

    redhat.com Keycloak org.keycloak:keycloak-services Maven
  • High 7.4
    CVE-2022-3143

    Wildfly-elytron possibly vulnerable to timing attacks via use of unsafe comparator

    wildfly-elytron: possible timing attacks via use of unsafe comparator. A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.…

    redhat.com Wildfly-elytron org.wildfly.security:wildfly-elytron Maven
  • Medium 6.5
    CVE-2023-0105

    Keycloak: Impersonation and lockout possible through incorrect handling of email trust

    A flaw was found in Keycloak. This flaw allows impersonation and lockout due to the email trust not being handled correctly in Keycloak. An attacker can shadow other users with the same email and lockout or impersonate them.

    redhat.com Keycloak org.keycloak:keycloak-core Maven
  • Low 3.8
    CVE-2023-0091

    Keycloak has lack of validation of access token on client registrations endpoint

    A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.

    redhat.com Keycloak org.keycloak:keycloak-core Maven
  • High 7.8
    CVE-2022-3841

    RHACM: unauthenticated SSRF in console API endpoint. A Server-Side Request Forgery (SSRF) vulnerability was found in th…

    redhat.com RHACM
  • Critical 9.1
    CVE-2022-3782 Public exploit

    Keycloak vulnerable to path traversal via double URL encoding

    keycloak: path traversal via double URL encoding. A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and pote…

    redhat.com Keycloak org.keycloak:keycloak-parent Maven