GHSA-4f53-xh3v-g8x4MediumCVSS 5.0

Keycloak secondary factor bypass in step-up authentication

Published
April 17, 2024
Last Modified
August 7, 2024

🔗 CVE IDs covered (1)

CVE-2023-3597 →

📋 Description

Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication.

🎯 Affected products2

  • maven/org.keycloak:keycloak-services:< 22.0.10
  • maven/org.keycloak:keycloak-services:>= 23.0.0, < 24.0.3

🔗 References (9)