OIDC Logout redirect in keycloak

低危 3.3CVE-2020-10734 · GHSA-rvjg-gxwx-j5gf · Published 11/02/2021 · updated 17/06/2026

要点

CVE-2020-10734 是影响 org.keycloak:keycloak-oidc-client-adapter-pom, jboss fuse (redhat), single sign-on (redhat) 的低危 (CVSS 3.3)漏洞。
未来 30 天内被利用的概率（EPSS）：0.21%，高于 11.3% 的漏洞。
修复：升级到 18.0.0 或更高版本。

Package	Affected versions	Patched versions
org.keycloak:keycloak-oidc-client-adapter-pom Maven	`< 18.0.0`	`18.0.0`
jboss fuse redhat	`= 7.0.0`	No fix yet
single sign-on redhat	`= 7.0`	No fix yet

Description

A flaw was found in keycloak. The OIDC logout endpoint does not have CSRF protection. The highest threat from this vulnerability is to system availability.

NVD description

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.

References

keycloak/keycloak security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-10734 · ADVISORY
bugzilla.redhat.com/show_bug.cgi · WEB
keycloak/keycloak · PACKAGE
issues.redhat.com/browse/KEYCLOAK-13653 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free