What is GHSA-rpj2-w6fr-79hc?

GHSA-rpj2-w6fr-79hc is a security advisory published by GitHub Security Advisories with Medium severity. Keycloak vulnerable to Improper Certificate Validation

Which CVE IDs does GHSA-rpj2-w6fr-79hc cover?

GHSA-rpj2-w6fr-79hc covers the following CVE IDs: CVE-2020-35509. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rpj2-w6fr-79hc?

GHSA-rpj2-w6fr-79hc has a CVSS v3 base score of 5.4, published by GitHub Security Advisories.

Which products are affected by GHSA-rpj2-w6fr-79hc?

GHSA-rpj2-w6fr-79hc affects 1 product, including: maven/org.keycloak:keycloak-core:\u003c 14.0.0.

GHSA-rpj2-w6fr-79hcMediumCVSS 5.4

Keycloak vulnerable to Improper Certificate Validation

Vendor

GitHub Security Advisories

Published

August 24, 2022

Last Modified

June 30, 2025

🔗 CVE IDs covered (1)

CVE-2020-35509 →

📋 Description

keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.

This issue was partially fixed in version 13.0.1 and more completely fixed in version 14.0.0.

🎯 Affected products1

maven/org.keycloak:keycloak-core:< 14.0.0

🔗 References (8)

https://nvd.nist.gov/vuln/detail/CVE-2020-35509
https://access.redhat.com/security/cve/cve-2020-35509
https://github.com/keycloak/keycloak/pull/6330
https://github.com/keycloak/keycloak/pull/8067
https://github.com/keycloak/keycloak/commit/478319348bdfdb9b6d39122f41edf2af79f679bb
https://bugzilla.redhat.com/show_bug.cgi?id=1912427
https://github.com/keycloak/keycloak/blob/4f330f4a57cbfcf6202b60546518261c66e59a35/services/src/main/java/org/keycloak/authentication/authenticators/x509/ValidateX509CertificateUsername.java#L74-L76
https://github.com/advisories/GHSA-rpj2-w6fr-79hc