REDHAT-BUG-1765129: Medium severity keycloak vulnerability

Published Oct 24, 2019

Updated

In some scenarios we mentioned that a user still has access to a resource after changing the role mappings in Keycloak and after expiration of the previous access token.

Upstream Issue:

https://issues.jboss.org/browse/KEYCLOAK-11145

Affected Software

1 affected component

Red Hat Keycloak

Event History

Oct 24, 2019

Data Sourced

via Red Hat·12:22 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1765129?

The severity of REDHAT-BUG-1765129 has not been explicitly stated, but it relates to improper role mapping behavior in Keycloak.

How do I fix REDHAT-BUG-1765129?

To address REDHAT-BUG-1765129, ensure that role mappings and token expiration are correctly handled in your Keycloak configuration.

What versions of Keycloak are affected by REDHAT-BUG-1765129?

REDHAT-BUG-1765129 affects the Red Hat Build of Keycloak, but specific vulnerable versions are not detailed.

What type of vulnerability is REDHAT-BUG-1765129?

REDHAT-BUG-1765129 is related to access control and role mapping issues in Keycloak.

Is there a workaround for REDHAT-BUG-1765129?

As of now, there are no documented workarounds for REDHAT-BUG-1765129, and users should monitor for updates from Red Hat.