CVE-2021-3461: High severity red hat keycloak vulnerability
A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].
Other sources
Keycloak may fail to logout user session if the logout request comes from external SAML identity provider that is set up to identify principal via attributes rather than Subject Name ID.
https://issues.redhat.com/browse/KEYCLOAK-17495
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3461?
CVE-2021-3461 is a vulnerability found in Keycloak that may fail to logout user session if the logout request comes from an external SAML identity provider and Principal Type is set to Attribute [Name].
What is the severity of CVE-2021-3461?
The severity of CVE-2021-3461 is high with a severity value of 7.1.
Which versions of Keycloak are affected by CVE-2021-3461?
Keycloak versions up to and excluding 9.0.13 are affected by CVE-2021-3461.
How can I fix CVE-2021-3461?
To fix CVE-2021-3461, update to Keycloak version 9.0.13 or higher.
Where can I find more information about CVE-2021-3461?
You can find more information about CVE-2021-3461 in the following references: - [CVE-2021-3461](https://www.cve.org/CVERecord?id=CVE-2021-3461) - [NVD](https://nvd.nist.gov/vuln/detail/CVE-2021-3461) - [Red Hat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi?id=1941565) - [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2021:2070)