CVE-2019-10199: Improper Input Validation and Cross-Site Request Forgery in Keycloak
Summary
CVE-2019-10199: Improper Input Validation and Cross-Site Request Forgery in Keycloak. Affects org.keycloak:keycloak-core versions < 7.0.0. Fixed in 7.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, social login, and user federation. Keycloak's account console is a web-based interface that allows users to manage their account settings and perform various operations. This vulnerability affects Keycloak versions up to 6.0.1.
Vulnerability Detail
The vulnerability in Keycloak's account console arises from inadequate header checks in certain requests. This flaw can be exploited by an attacker to deceive an authenticated user into performing unintended operations through requests from untrusted domains. The impact of this vulnerability can be severe, as it allows an attacker to manipulate user actions and potentially gain unauthorized access to sensitive information.
How To Fix
Latest published version: 26.8.1 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
7.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement additional security measures such as enforcing strict referer policies or using CSRF tokens. However, these workarounds may require modifications to the application code and are not as effective as applying the official fix by upgrading Keycloak.
Conclusion
In conclusion, the vulnerability in Keycloak's account console can lead to unauthorized actions by authenticated users. It is crucial to apply the recommended fix by upgrading to Keycloak version 7.0.0 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-core →
FAQ
Keycloak is an open-source identity and access management solution that provides features such as single sign-on, social login, and user federation.
The account console is a web-based interface in Keycloak that allows users to manage their account settings and perform various operations.
Cross-site request forgery is an attack that tricks an authenticated user into performing unintended actions on a web application.
This vulnerability can allow an attacker to manipulate user actions and potentially gain unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to upgrade to Keycloak version 7.0.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for org.keycloak:keycloak-core.
