Vulnerability GHSA-f4v7-3mww-9gc2
Medium Risk
MEDIUM RISK
CVSS Score: 4.9
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
1 year ago
January 13, 2025 at 04:58 PM UTC
Keycloak allows unrestricted admin use of system and environment variables
12.0.0 - 26.0.7
12.0.0 - 26.0.7
Summary
Keycloak allows unrestricted admin use of system and environment variables
Details
A security vulnerability has been identified that allows admin users to access sensitive server environment variables and system properties through user-configurable URLs. Specifically, when configuring backchannel logout URLs or admin URLs, admin users can include placeholders like ${env.VARNAME} or ${PROPNAME}. The server replaces these placeholders with the actual values of environment variables or system properties during URL processing.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
8 months ago
Keycloak logs sensitive headers
12.0.0 - 26.5.5 GHSA-gv3v-2cpp-3pmq
12.0.0 - 26.5.5 GHSA-gv3v-2cpp-3pmq
Low Risk
9 months ago
Keycloak has an improper input validation vulnerability
12.0.0 - 26.2.5 GHSA-v897-pv23-r8cw
12.0.0 - 26.2.5 GHSA-v897-pv23-r8cw
Low Risk
11 months ago
Keycloak unable to restrict access to the admin console
12.0.0 - 26.4.3 GHSA-vjr8-56p3-fmqq
12.0.0 - 26.4.3 GHSA-vjr8-56p3-fmqq
Medium Risk
1 year ago
Keycloak on Quarkus CLI option for encrypted JGroups ignored
25.0.0 - 26.0.5 GHSA-g6qq-c9f9-2772
25.0.0 - 26.0.5 GHSA-g6qq-c9f9-2772
Medium Risk
1 year ago
Denial of Service in Keycloak Server via Security Headers
12.0.0 - 26.0.7 GHSA-w3g8-r9gw-qrh8
12.0.0 - 26.0.7 GHSA-w3g8-r9gw-qrh8
Impacted packages
Timeline
Published
1 year ago
January 13, 2025 at 04:58 PM UTC
Fixed (26.0.8)
Unknown
Unknown
Last Modified
1 month ago
September 10, 2026 at 03:50 AM UTC