CVE-2020-10734: CSRF

Published May 5, 2020
·
Updated

A vulnerability was found in keycloak in the way that the OIDC logout endpoint do not have CSRF protection.

Reference: https://issues.redhat.com/browse/KEYCLOAK-13653

Other sources

A vulnerability was found in keycloak in the way that the OIDC logout endpoint does not have CSRF protection. Versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes are believed to be vulnerable.

Affected Software

5 affected componentsFixes available
redhat/keycloak<18.0.0
18.0.0
redhat keycloak
redhat Jboss Fuse=7.0.0
redhat Openshift Application Runtimes
redhat Single Sign-on=7.0

Event History

May 5, 2020
Data Sourced
via Red Hat·12:54 PM
DescriptionSeverityAffected Software
Feb 11, 2021
CVE Published
via MITRE·03:29 PM
Data Sourced
via MITRE·03:29 PM
DescriptionWeakness
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2020-10734?

CVE-2020-10734 is a vulnerability found in Keycloak that affects versions shipped with Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes.

2

What is the severity of CVE-2020-10734?

The severity of CVE-2020-10734 is low, with a severity value of 3.3.

3

How does CVE-2020-10734 impact Keycloak?

CVE-2020-10734 impacts Keycloak by not having CSRF protection in the OIDC logout endpoint.

4

Which software is affected by CVE-2020-10734?

CVE-2020-10734 affects Red Hat Fuse 7, Red Hat Single Sign-on 7, and Red Hat Openshift Application Runtimes.

5

How can I mitigate CVE-2020-10734?

To mitigate CVE-2020-10734, update to version 18.0.0 or later of Keycloak.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203