Homepage
About Snyk

Open Redirect Affecting org.keycloak:keycloak-services package, versions [1.0.1.Final,1.0.3.Final)

0.0
medium

Snyk CVSS

    Attack Complexity Low

    Threat Intelligence

    EPSS 0.08% (36th percentile)
Expand this section
NVD
6.1 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JAVA-ORGKEYCLOAK-31230
  • published 16 Dec 2015
  • disclosed 16 Dec 2015
  • credit Florian Weimer
Report a new vulnerability Found a mistake?

Introduced: 16 Dec 2015

CVE-2014-3652 Open this link in a new tab
CWE-601 Open this link in a new tab

Overview

org.keycloak:keycloak-services Affected versions of the package are vulnerable to Open Redirect. It was identified that the login redirect implementation provided by JBoss KeyCloak did not validate the redirect URL. This flaw could be used by a remote attacker to conduct phishing attacks by redirecting users to arbitary websites.

References