Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.3

Keycloak Before 13.0.0 May Leak Sensitive Data Via Unverified URL

CVE-2020-10770 · published 5 years ago
Summary

Keycloak servers before version 13.0.0 may allow an attacker to trick the server into making unauthorized requests to external URLs. This could potentially expose sensitive information or disrupt service. Update to Keycloak 13.0.0 or later to fix this issue.

What to do
  • Update keycloak org.keycloak:keycloak-core to version 13.0.0.
  • Update redhat keycloak to version 12.0.2 or later.
Affected software
Ecosystem VendorProductAffected versions
maven keycloak org.keycloak:keycloak-core < 13.0.0
Fix: upgrade to 13.0.0
– redhat keycloak < 12.0.2
cpe:2.3:a:redhat:keycloak:*:*:*:*:*:*:*:*
Original advisory text
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this par...
A flaw was found in Keycloak before 13.0.0, where it is possible to force the server to call out an unverified URL using the OIDC parameter request_uri. This flaw allows an attacker to use this parameter to execute a Server-side request forgery (SSRF) attack.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.3 Medium
Exploitation
70% chance of attack within 30 days
Type
CWE-601Open Redirect
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published15 Dec 2020
Updated15 Jun 2026
First seen6 Mar 2026
Sources
GHSA-jh7q-5mwf-qvhw · GHSA
CVE-2020-10770 · NVD
Track software like this
Free during beta