GitHub Advisoryadvisory · Maven

GHSA-93ww-43rr-79v3 Keycloak mTLS Authentication Bypass via Reverse Proxy TLS Termination

HIGH Published 2024-11-25 Modified 2025-01-30 Official page ↗
Aliases
CVE-2024-10039
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
High
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-295
Reviewed
2024-11-25

Affected packages

• Maven org.keycloak:keycloak-core: < 26.0.6 → fixed in 26.0.6

Description

A vulnerability was found in Keycloak. Deployments of Keycloak with a reverse proxy not using pass-through termination of TLS, with mTLS enabled, are affected. This issue may allow an attacker on the local network to authenticate as any user or client that leverages mTLS as the authentication mechanism.

Related

Alias · not in database (1)

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References