GHSA-fv4q-wm8c-wjg4

ghsaUSosv

Keycloak Authentication Error

view advisory published 2022-05-24Licence: CC-BY-4.0

A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-14909US	high8.3	1.08% (65th)	—	2019-12-04
A vulnerability was found in Keycloak 7.x where the user federation LDAP bind type is none (LDAP anonymous bind), any password, invalid or valid will be accepted.

references

External citations — patches, advisories, analysis.

https://access.redhat.com/security/cve/cve-2019-14909WEB
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14909WEB
https://github.com/keycloak/keycloakPACKAGE
https://nvd.nist.gov/vuln/detail/CVE-2019-14909ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan