GitHub Advisoryadvisory · Maven

GHSA-cm29-6wx7-p874 Keycloak insufficient session expiration

HIGH Published 2022-04-03 Modified 2023-07-11 Official page ↗

Aliases: CVE-2021-3461
Ecosystem: Maven
Packages: org.keycloak:keycloak-parent
Severity: High
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Weaknesses: CWE-613
Reviewed: 2023-07-11

Affected packages

• Maven org.keycloak:keycloak-parent: < 14.0.0 → fixed in 14.0.0

Description

A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity provider and Principal Type is set to Attribute [Name].

Weakness · not in database (1)

CWE-613

Alias · CVE (1)

CVE-2021-3461 A flaw was found in keycloak where keycloak may fail to logout user session if the logout request comes from external SAML identity… vulnerability

References