Description

A vulnerability was found in Keycloak before 9.0.2, where every Authorization URL that points to an IDP server lacks proper input validation as it allows a wide range of characters. This flaw allows a malicious to craft deep links that introduce further attack scenarios on affected clients.

Remediation

References

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1727

Related Vulnerabilities

CVE-2019-1003085 Vulnerability in maven package org.jenkins-ci.plugins:zephyr-enterprise-test-management

CVE-2023-37905 Vulnerability in npm package ckeditor-wordcount-plugin

CVE-2016-3088 Vulnerability in maven package org.apache.activemq:activemq-fileserver

CVE-2023-6460 Vulnerability in npm package @google-cloud/firestore

CVE-2023-27905 Vulnerability in maven package org.jenkins-ci:update-center2

Severity

Medium

Classification

CWE-20 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Tags

Issue Tracking Vendor Advisory