# Redhat Single Sign-On


- [CVE-2023-44487](https://insights.sbomify.com/CVE-2023-44487/): HTTP/2 Rapid Reset Attack (high 7.5, exploited in the wild)
- [CVE-2022-4361](https://insights.sbomify.com/CVE-2022-4361/): Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC (critical 10.0)
- [CVE-2019-14379](https://insights.sbomify.com/CVE-2019-14379/): Deserialization of untrusted data in FasterXML jackson-databind (critical 9.8)
- [CVE-2025-12543](https://insights.sbomify.com/CVE-2025-12543/): Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests (critical 9.6)
- [CVE-2019-14837](https://insights.sbomify.com/CVE-2019-14837/): keycloak vulnerable to unauthorized login via mail server setup (critical 9.1)
- [CVE-2026-28367](https://insights.sbomify.com/CVE-2026-28367/): Undertow: undertow: request smuggling via `\r\r\r` as a header block terminator (high 8.7)
- [CVE-2026-28368](https://insights.sbomify.com/CVE-2026-28368/): Undertow: undertow: request smuggling via inconsistent header parsing (high 8.7)
- [CVE-2026-28369](https://insights.sbomify.com/CVE-2026-28369/): Undertow: undertow: request smuggling via malformed http request headers (high 8.7)
- [CVE-2026-15573](https://insights.sbomify.com/CVE-2026-15573/): Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher (high 8.1)
- [CVE-2026-16102](https://insights.sbomify.com/CVE-2026-16102/): Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers (high 8.1)
- [CVE-2026-3009](https://insights.sbomify.com/CVE-2026-3009/): Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator (high 8.1)
- [CVE-2024-1132](https://insights.sbomify.com/CVE-2024-1132/): Keycloak: path transversal in redirection validation (high 8.1)

---
From sbomify Insights: https://insights.sbomify.com/products/redhat/single-sign-on/