| Package | Affected versions | Patched versions |
|---|---|---|
| org.keycloak:keycloak-core | < 14.0.0 | 14.0.0 |
| keycloak | = 11.0.3= 12.0.0 |
keycloak accepts an expired certificate by the direct-grant authenticator because of missing time stamp validations. The highest threat from this vulnerability is to data confidentiality and integrity.
This issue was partially fixed in version 13.0.1 and more completely fixed in version 14.0.0.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free