GitHub Advisoryadvisory · Maven

GHSA-jf86-9434-f8c2 Keycloak Authentication Error

CRITICAL Published 2022-05-24 Modified 2023-09-26 Official page ↗
Aliases
CVE-2019-14910
Ecosystem
Maven
Packages
org.keycloak:keycloak-parent
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-278, CWE-295
Reviewed
2023-07-18

Affected packages

• Maven org.keycloak:keycloak-parent: >= 7.0.0, <= 7.0.1 (no fix yet)

Description

A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS from the LDAP server (ldaps), in this case user authentication succeeds even if invalid password has entered.

Related

Alias · CVE (1)

  • CVE-2019-14910 A vulnerability was found in keycloak 7.x, when keycloak is configured with LDAP user federation and StartTLS is used instead of SSL/TLS… vulnerability

Weakness · CWE (2)

  • CWE-278 Insecure Preserved Inherited Permissions weakness
  • CWE-295 Improper Certificate Validation weakness

References