REDHAT-BUG-2537744: Medium severity Red Hat Keycloak vulnerability
A flaw was found in the keycloak-services component where it fails to properly validate the KDC identity during Kerberos password authentication. When Kerberos password mode is enabled without SPNEGO/negotiate authentication, Keycloak does not request a server ticket in the name of the authenticating user to verify the KDC response. An attacker capable of performing DNS, ARP, or DHCP spoofing on the local network can provide a fraudulent KDC response. Successful exploitation allows an attacker to bypass authentication entirely and impersonate any user, leading to unauthorized access to sensitive data and administrative functions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this authentication bypass?
Deployments using Kerberos password authentication mode without SPNEGO/negotiate authentication are exposed. The issue is in the keycloak-services component.
What does an attacker need to exploit the issue?
The attacker must be able to spoof DNS, ARP, or DHCP on the local network and provide a fraudulent KDC response. This is a local-network attacker scenario rather than an unauthenticated remote attack described by the available data.
What is the impact of successful exploitation?
An attacker can bypass authentication and impersonate any user. This can provide unauthorized access to sensitive data and administrative functions.