| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-ldap-federation | ≥ 26.3.0, < 26.4.6< 26.2.11 | 26.4.626.2.11 |
A flaw was found in the Keycloak LDAP User Federation provider. This vulnerability allows an authenticated realm administrator to trigger deserialization of untrusted Java objects via a malicious LDAP server configuration.
Disable LDAP referrals in all LDAP user providers in all realms if projects cannot upgrade to the patched versions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free