| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-services | < 21.0.1 | 21.0.1 |
| keycloak | < 18.0.6 | 18.0.6 |
| openshift container platform | = 4.10= 4.9 | |
| openshift container platform for ibm linuxone | = 4.10= 4.9 | |
| openshift container platform ibm z systems | = 4.10= 4.9 | |
| single sign-on | < 7.6.2 | 7.6.2 |
Keycloak's OpenID Connect user authentication was found to incorrectly authenticate requests. An authenticated attacker who could also obtain a certain piece of info from a user request, from a victim within the same realm, could use that data to impersonate the victim and generate new session tokens.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free