What is GHSA-mwm4-5qwr-g9pf?

GHSA-mwm4-5qwr-g9pf is a security advisory published by GitHub Security Advisories with Low severity. Keycloak is vulnerable to IDN homograph attack

Why does GHSA-mwm4-5qwr-g9pf have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-mwm4-5qwr-g9pf?

GHSA-mwm4-5qwr-g9pf affects 1 product, including: maven/org.keycloak:keycloak-services:\u003c 18.0.0.

GHSA-mwm4-5qwr-g9pfLowDisclosed before NVD

Keycloak is vulnerable to IDN homograph attack

Vendor

GitHub Security Advisories

Published

April 28, 2022

Last Modified

January 7, 2023

📋 Description

A flaw was found in keycloak, where IDN homograph attacks are possible. This flaw allows a malicious user to register a name that already exists and then tricking an admin to grant extra privileges. The highest threat from this vulnerability is to integrity.

🎯 Affected products1

maven/org.keycloak:keycloak-services:< 18.0.0

🔗 References (3)

https://github.com/keycloak/keycloak/security/advisories/GHSA-mwm4-5qwr-g9pf
https://github.com/keycloak/keycloak/commit/ac79fd0c23c6947a04073afc61e30d341498438e
https://github.com/advisories/GHSA-mwm4-5qwr-g9pf