REDHAT-BUG-2221760: Medium severity keycloak vulnerability

Published Jul 10, 2023

Updated

Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication.

Affected Software

1 affected component

Red Hat Keycloak

Event History

Jul 10, 2023

Data Sourced

via Red Hat·05:10 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-2221760?

REDHAT-BUG-2221760 is considered a critical severity vulnerability due to its potential for unauthorized access through step-up authentication.

How do I fix REDHAT-BUG-2221760?

To fix REDHAT-BUG-2221760, update your Red Hat Build of Keycloak to the latest patched version provided by Red Hat.

Who is affected by REDHAT-BUG-2221760?

Users of the Red Hat Build of Keycloak are affected by the vulnerability identified as REDHAT-BUG-2221760.

What type of attack does REDHAT-BUG-2221760 enable?

REDHAT-BUG-2221760 enables a password-authenticated attack that allows an attacker to falsely register a second authentication factor.

When was REDHAT-BUG-2221760 reported?

REDHAT-BUG-2221760 was reported as part of a security vulnerability disclosure process and has associated errata updates for resolution.