~ / search / GHSA-gf2j-7qwg-4f5x

GHSA-gf2j-7qwg-4f5x

Improper Authentication in Keycloak

Source: GitHub Advisory Database (reviewed) High CVE-2018-14637

Packages

EcosystemPackageAffectedFixed in
Maven org.keycloak:keycloak-core < 4.6.0 4.6.0

Details

As written in the advisory (Markdown source, shown as plain text).

The SAML broker consumer endpoint in Keycloak before version 4.6.0.Final ignores expiration conditions on SAML assertions. An attacker can exploit this vulnerability to perform a replay attack.

References

External links from the advisory. They lead to third-party sites.