GHSA-72j4-94rx-cr6wMediumCVSS 4.9

Incorrect Permission Assignment for Critical Resource and Permissive List of Allowed Inputs in Keycloak

Published
February 9, 2022
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2020-1694 →

📋 Description

A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.

🎯 Affected products1

  • maven/org.keycloak:keycloak-parent:< 10.0.0

🔗 References (3)