Not rated
CVE-2021-3827 A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed
Description
A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior, an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Keycloak | Versions not published |
References
- github.com github.com
- github.com github.com
- bugzilla.redhat.com bugzilla.redhat.com
- access.redhat.com access.redhat.com
Timeline
- Published
- Last modified
Other CVEs of Keycloak
The 36 CVEs of Keycloak →
CVE-2023-4918
A flaw was found in the Keycloak package, more specifically org.keycloak.userprofile
8.8
High
CVE-2023-1664
A flaw was found in Keycloak
6.5
Medium
CVE-2022-1274
A flaw was found in Keycloak in the execute-actions-email endpoint
Not rated
CVE-2022-2237
A flaw was found in the Keycloak Node.js Adapter
6.1
Medium