GitHub Advisoryadvisory · Maven

GHSA-rpj2-w6fr-79hc Keycloak vulnerable to Improper Certificate Validation

MEDIUM Published 2022-08-24 Modified 2025-06-30 Official page ↗
Aliases
CVE-2020-35509
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-20, CWE-295
Reviewed
2022-12-05

Affected packages

• Maven org.keycloak:keycloak-core: < 14.0.0 → fixed in 14.0.0

Description

keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity. This issue was partially fixed in version 13.0.1 and more completely fixed in version 14.0.0.

Related

Alias · CVE (1)

  • CVE-2020-35509 A flaw was found in keycloak affecting versions 11.0.3 and 12.0.0. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-295 Improper Certificate Validation weakness

References