| Package | Affected versions | Patched versions |
|---|---|---|
| build of keycloak | ≥ 26.4, < 26.4.14≥ 26.6, < 26.6.5 | 26.4.1426.6.5 |
A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free