GHSA-xv7h-95r7-595j
Incorrect implementation of lockout feature in Keycloak
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | org.keycloak:keycloak-parent | < 13.0.0 | 13.0.0 |
Details
As written in the advisory (Markdown source, shown as plain text).
A flaw was found in keycloak where a brute force attack is possible even when the permanent lockout feature is enabled. This is due to a wrong error message displayed when wrong credentials are entered. The highest threat from this vulnerability is to confidentiality.
References
External links from the advisory. They lead to third-party sites.