CVE-2021-3827: Medium severity redhat keycloak vulnerability
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
Other sources
For each SAML client it is possible to send an AuthnRequest message via SOAP with Basic Authorization header and Keycloak will successfully authenticate the user for the client and will not consider the authentication flow applied.
The presence of the flow is hidden from the administrator, it is not possible to disable it in the client's configuration similarly as direct grant etc.
https://issues.redhat.com/browse/KEYCLOAK-19177
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-3827?
CVE-2021-3827 is a vulnerability found in Keycloak that allows other authentication flows to be bypassed, potentially enabling an attacker to bypass MFA authentication.
How does CVE-2021-3827 work?
CVE-2021-3827 works by exploiting the default ECP binding flow in Keycloak, allowing an attacker to bypass MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header containing the user's credentials.
What is the severity of CVE-2021-3827?
CVE-2021-3827 has a severity rating of 6.8 (medium).
Which software versions are affected by CVE-2021-3827?
Keycloak versions up to and excluding 18.0.0, rh-sso7-keycloak versions 0:15.0.4-1.redhat_00001.1.el7 and 0:15.0.4-1.redhat_00001.1.el8, and redhat-sso version 7-sso75-openshift-rhel8 are affected by CVE-2021-3827.
How can I mitigate CVE-2021-3827?
To mitigate CVE-2021-3827, update your Keycloak and related software to versions that include the necessary fixes. Refer to the provided remediation links for more information.