GitHub Advisoryadvisory · Maven

GHSA-mwm4-5qwr-g9pf Keycloak is vulnerable to IDN homograph attack

LOW Published 2022-04-28 Modified 2022-04-28 Official page ↗
Ecosystem
Maven
Packages
org.keycloak:keycloak-services
Severity
Low
Weaknesses
CWE-284
Reviewed
2022-04-28

Affected packages

• Maven org.keycloak:keycloak-services: < 18.0.0 → fixed in 18.0.0

Description

A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity.

Related

Weakness · CWE (1)

  • CWE-284 Improper Access Control weakness

References