Описание
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.
Дополнительная информация
Статус:
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
A flaw was found in Keycloak. A Keycloak server configured to support mTLS authentication for OAuth/OpenID clients does not properly verify the client certificate chain. A client that possesses a proper certificate can authorize itself as any other client, therefore, access data that belongs to other clients.
A flaw was found in Keycloak. A Keycloak server configured to support ...
Keycloak vulnerable to Improper Client Certificate Validation for OAuth/OpenID clients
Уязвимость программного средства для управления идентификацией и доступом Keycloak, связанная с ошибками процедуры подтверждения подлинности сертификата, позволяющая нарушителю оказать воздействие на конфиденциальность и целостность защищаемой информации
EPSS
5.5 Medium
CVSS3