CVE-2020-10734: OIDC Logout redirect vulnerability in keycloak
Summary
CVE-2020-10734: OIDC Logout redirect in keycloak. Affects org.keycloak:keycloak-oidc-client-adapter-pom versions < 18.0.0. Fixed in 18.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Keycloak is an open-source identity and access management solution that allows organizations to secure their applications and services. It provides features such as single sign-on, user federation, and social login. The keycloak-oidc-client-adapter-pom package is a Maven package that provides an adapter for integrating Keycloak with OpenID Connect (OIDC) clients. This package is used to enable OIDC authentication and authorization in applications.
Vulnerability Detail
A vulnerability has been discovered in keycloak-oidc-client-adapter-pom that affects the OIDC logout endpoint. The logout endpoint does not have Cross-Site Request Forgery (CSRF) protection, which can allow an attacker to perform unauthorized logout actions on behalf of a user. This vulnerability can lead to system availability issues, potentially disrupting the functionality of the affected application.
How To Fix
Latest published version: 25.0.6 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
18.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading the keycloak-oidc-client-adapter-pom package.
Conclusion
The OIDC logout redirect vulnerability in keycloak-oidc-client-adapter-pom can lead to system availability issues. It is crucial to upgrade the package to the recommended version to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.keycloak:keycloak-oidc-client-adapter-pom →
FAQ
This vulnerability can lead to system availability issues, potentially disrupting the functionality of the affected application.
To fix this vulnerability, upgrade the keycloak-oidc-client-adapter-pom package to version 18.0.0 or later.
No, there is no known workaround for this vulnerability. It is essential to apply the recommended fix.
You can find more information about this vulnerability in the CVE-2020-10734 advisory.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
