GHSA-4pc7-vqv5-5r3v
ECP SAML binding bypasses authentication flows
At a glance
- Published
- Updated
- CVE
- CVE-2021-3827
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Description
### Description A flaw was found in keycloak, where the default ECP binding flow allows other authentication flows to be bypassed. By exploiting this behavior an attacker can bypass the MFA authentication by sending a SOAP request with an AuthnRequest and Authorization header with the user's credentials. The highest threat from this vulnerability is to confidentiality and integrity.
Affected packages
| Package | Versions |
|---|---|
| Maven · org.keycloak:keycloak-saml-core | introduced 0, fixed 18.0.0 |
References
- https://github.com/keycloak/keycloak/security/advisories/GHSA-4pc7-vqv5-5r3v WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-3827 ADVISORY
- https://github.com/keycloak/keycloak/commit/44000caaf5051d7f218d1ad79573bd3d175cad0d WEB
- https://access.redhat.com/security/cve/CVE-2021-3827 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=2007512 WEB
- https://github.com/keycloak/keycloak PACKAGE
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |