GitHub Advisoryadvisory · Maven

GHSA-m9cj-v55f-8x26 Authentication Bypass in keycloak

HIGH Published 2022-03-18 Modified 2022-03-18 Official page ↗
Aliases
CVE-2020-27826
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-250
Reviewed
2021-06-01

Affected packages

• Maven org.keycloak:keycloak-core: < 12.0.0 → fixed in 12.0.0

Description

A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. This flaw allows an attacker to change its own NameID attribute to impersonate the admin user for any particular application.

Related

Alias · CVE (1)

  • CVE-2020-27826 A flaw was found in Keycloak before version 12.0.0 where it is possible to update the user's metadata attributes using Account REST API. vulnerability

Weakness · CWE (1)

  • CWE-250 Execution with Unnecessary Privileges weakness

References