1. Home
  2. Security Advisories
  3. Maven
  4. MAVEN:GHSA-46C8-635V-68R2

[MAVEN:GHSA-46C8-635V-68R2] Keycloak Authorization Bypass vulnerability

Severity Moderate
Affected Packages 2
Fixed Packages 2
CVEs 1
Info Packages References Vulnerabilities

Due to a permissive regular expression hardcoded for filtering allowed hosts to register a dynamic client, a malicious user with enough information about the environment could benefit and jeopardize an environment with this specific Dynamic Client Registration with TrustedDomain configuration previously unauthorized.

Acknowledgements:

Special thanks to Bastian Kanbach for reporting this issue and helping us improve our security.

Package Affected Version
pkg:maven/org.keycloak/keycloak-services >= 23.0.0, < 24.0.3
pkg:maven/org.keycloak/keycloak-services < 22.0.10
Package Fixed Version
pkg:maven/org.keycloak/keycloak-services = 24.0.3
pkg:maven/org.keycloak/keycloak-services = 22.0.10
ID
MAVEN:GHSA-46C8-635V-68R2
Severity
moderate
URL
https://github.com/advisories/GHSA-46c8-635v-68r2
Published
2024-04-17T17:33:29
(5 months ago)
Modified
2024-04-17T17:33:29
(5 months ago)
Rights
Maven Security Team
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:maven/org.keycloak/keycloak-services org.keycloak keycloak-services >= 23.0.0 < 24.0.3
Fixed pkg:maven/org.keycloak/keycloak-services org.keycloak keycloak-services = 24.0.3
Affected pkg:maven/org.keycloak/keycloak-services org.keycloak keycloak-services < 22.0.10
Fixed pkg:maven/org.keycloak/keycloak-services org.keycloak keycloak-services = 22.0.10
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date