REDHAT-BUG-2319217: High severity Red Hat Keycloak vulnerability

Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected by an issue where an attacker on the local network can authenticate as any user or client that leverages mTLS as the authentication mechanism.

Trusted proxies introduced in Keycloak 26 can mitigate this to some extent by only accepting certificates from proxy headers if the request is coming from the IP address of the proxy. However, this is a very weak form of authentication as IP addresses can in many cases be spoofed.

The attacker would need to have access to the local network, and in addition gain access to the corresponding public certificates, which in many cases is not the hardest thing to do, especially considering that we are assuming an insider, or an attacker that has gained access to the local network.

Additionally, Keycloak can further be configured to not only obtain certificates through HTTP headers, but also to not validate the certificates. If this option is enabled for a deployment the attacker does not have to obtain the actual public certificate, and can simply generate a random one with for example openssl with whatever subject they want.