| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-services | ≥ 23.0.0, < 24.0.3< 22.0.10 | 24.0.322.0.10 |
Keycloak does not correctly validate its client step-up authentication. A password-authed attacker could use this flaw to register a false second auth factor, alongside the existing one, to a targeted account. The second factor then permits step-up authentication.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free