Keycloak Unauthenticated Access

2022-05-2416:58:47

Google

osv.dev

0.001 Low

EPSS

Percentile

37.2%

JSON

A flaw was found in the Keycloak REST API before version 8.0.0, implemented in Keycloak before 7.0.1 where it would permit user access from a realm the user was not configured. An authenticated attacker with knowledge of a user id could use this flaw to access unauthorized information or to carry out further attacks.

CPENameOperatorVersion
org.keycloak:keycloak-model-jpaeq3.4.1.Final
org.keycloak:keycloak-model-jpaeq3.2.1.Final
org.keycloak:keycloak-model-jpaeq1.9.7.Final
org.keycloak:keycloak-model-infinispaneq2.5.0.Final
org.keycloak:keycloak-model-jpaeq3.4.3.Final
org.keycloak:keycloak-model-infinispaneq5.0.0
org.keycloak:keycloak-model-jpaeq6.0.0
org.keycloak:keycloak-model-jpaeq2.5.0.Final
org.keycloak:keycloak-model-jpaeq5.0.0
org.keycloak:keycloak-model-jpaeq4.8.3.Final

Name	Operator	Version
org.keycloak:keycloak-model-jpa	eq	3.4.1.Final
org.keycloak:keycloak-model-jpa	eq	3.2.1.Final
org.keycloak:keycloak-model-jpa	eq	1.9.7.Final
org.keycloak:keycloak-model-infinispan	eq	2.5.0.Final
org.keycloak:keycloak-model-jpa	eq	3.4.3.Final
org.keycloak:keycloak-model-infinispan	eq	5.0.0
org.keycloak:keycloak-model-jpa	eq	6.0.0
org.keycloak:keycloak-model-jpa	eq	2.5.0.Final
org.keycloak:keycloak-model-jpa	eq	5.0.0
org.keycloak:keycloak-model-jpa	eq	4.8.3.Final