| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-core | < 8.0.0 | 8.0.0 |
| jboss enterprise application platform | = 6.4.0= 7.2.0 | |
| jboss fuse | = 7.0.0 | |
| keycloak | < 8.0.0 | 8.0.0 |
| single sign-on | = 7.3 |
It was found that keycloak before version 8.0.0 exposes internal adapter endpoints in org.keycloak.constants.AdapterConstants, which can be invoked via a specially-crafted URL. This vulnerability could allow an attacker to access unauthorized information.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free