GitHub Advisoryadvisory · Maven

GHSA-xf46-8vvp-4hxx Keycloak Missing authentication for critical function

MEDIUM Published 2021-03-12 Modified 2023-09-07 Official page ↗
Aliases
CVE-2021-20262
Ecosystem
Maven
Packages
org.keycloak:keycloak-core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-306
Reviewed
2021-03-12

Affected packages

• Maven org.keycloak:keycloak-core: <= 12.0.4 (no fix yet)

Description

A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. This flaw allows an attacker to take over an account if they can obtain temporary, physical access to a user’s browser. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Related

Alias · CVE (1)

  • CVE-2021-20262 A flaw was found in Keycloak 12.0.0 where re-authentication does not occur while updating the password. vulnerability

Weakness · CWE (1)

  • CWE-306 Missing Authentication for Critical Functionality weakness

References